NetApp ActiveIQ Unified Manager - HTTPS

[NEO-BAHAMUT]

Hi All, 

We have recently installed NetApp IQ Unified Manager, and in this last week ive upgraded the system to the latest version at this time, 9.16P2.

I'm trying to configure the system to use a ca generated certificate rather than the self-generated cert. - Now I dont claim to be any sort of PKI expert, but i have generated lots of certs in my time and got them working. However for this i am sort of stumped.

I've used the GUI to generate the CSR file. I've submitted this to our internal CA and i've got a .cer file back. Ive converted it to a .pem file and when i try to upload the cert if gives me the following error.

When i install the cert in windows I can see that there is a full chain on the cert. ActiveIQ doesn't appear to be able to see that. I'm guessing its something im doing wrong.

Can anyone confirm the steps that do work and i can try again. Or is this a bug?

[NEO-BAHAMUT · Accepted solution]

Ok just thought i'd let you know that i have managed to get this working using the below steps

#####################Active IQ Cert Install#################

Generate Certificate for NetAppActive IQ Unified Manager
1. Generate CSR file. - Login to NetApp ActiveIQ Unified Manager, under General>HTTPS Certiciates> Download HTTPS Certificate Signing Request
2. Submit the csr to the CA to generate a .cer file using the below command
certreq -submit -config "YOUR_INTERNAL_CA_HERE" -attrib "CertificateTemplate:YOUR_WEB_SERVER_TEMPLATE_HERE" -kerberos "Path\To\CSR_File.csr" "Path\To\CerFile.cer"
3. Using the guide on this page, export the cert as a p7b format
https://support.axway.com/kb/178782/language/en
4. Using the NetApp article found below use the command in step 4 to convert a DER encoded cert to a pem file.
https://kb.netapp.com/data-mgmt/AIQUM/AIQUM_Kbs/How_to_generate_and_convert_a_signed_certificate_for_Active_IQ_Unified_Manager#How_to_sign_the_certifi...
5. Try importing (It will probably fail), if it doesn't work you must make it look like how it specifies on NetApp'a site at the below site. You might have to move the certs around in the file
https://docs.netapp.com/us-en/active-iq-unified-manager/config/task_install_ca_signed_and_returned_https_certificate.html

6. Import again and you should get a success message. Reboot your server and should be all good.

Hope this helps someone. - if not it will help me next year 😄