HMC Certificate Signing

How to install a signed certificate on the HMC.

How to get to the Wizard:
Classic GUI: HMC Management -> Manage Certificates -> Create -> New Certificate

Enhanced+ GUI: Click Padlock on left panel -> Systems and Console Security -> Manage Certificates -> Create -> New Certificate

After that the wizard will open. The HMC does have the option as well, as you can see below, to do a Self-signed certificate. Where-as the HMC signs the certificate itself, rather than a known Certificate Authority.


1) Generate a signing request
Click Create, New Certificate, signed by a certificate authority



Save signing request, csr.file.

2) Sign the signing request



3) Import the signed certificate and the CA
Use the "Manage Certificates" task to import the signed certificate (i.e. file /tmp/server.crt) and the CA certificate (i.e. /tmp/ca.crt) after scping them to the system with the remote browser.

We have a video that shows the proper order of installing a certificate chain.




Note: If you cancelled out of the import (i.e. in your example at the point when being asked for the optional signing certificate(s)) you should not have to regenerate the request and just startup the import task again. However, if you import just the signed server certificate and specify no signing certificates when prompted, this will install the signed server certificate and there is no option later to add the signing certificate(s) if there are any. In other words, if you forget (or ignore) to import the signing certificates when importing the signed server certificate, you do not have an option to later add them.




Specify the signed server certificate (server.crt).




Add one (or more) signer certificates (ca.crt). When importing multiple signers (a certificate chain) list the signers in order with the root CA last.




4) Reboot
You must reboot (not just the HMC prompted restart) for 5250 proxy to pick up the change.

5) Add the CA to the IBM Key Manager
In iSeries Access for Windows, add the signer certificate if needed. Once the CA is added, you can connect to any HMC with a server certificate signed by the CA.


The result should be a certificate chain with at minimum of the CA followed by the server certificate.