Controllerless Networks

Hi,

Does anyone know if you can change the inbuilt certificate used for the HTTPS management GUI from instant.arubanetworks.com to another certificate, for example an internal CA  certificate to remove the security warning when browseing to the virtual controller to manage it.

cheers

Dave

https://arubanetworkskb.secure.force.com/pkb/articles/HowTo/R-1481

Thanks, If i have understtod this correctly it looks to be creating a new root CA and computer cert to then install on the Instant, this root CA would then need to be installed on any clients browsing on to the GUI to trust it.

What i actually need to do is use an existing miscosoft Domain CA to issue a cert for the Instant as the root CA is already on the clients.

Is this possible ?

Dave

Do you have access to the ADCS server? Use the IIS snap-in to create a certificate signing request and then use the ADCS web UI to request the certificate. It will just be a standard SSL server certificate.

OK, i managed to create a CSR and get a cert for the Aruba Instant. but its not being used as the defualt cert, how do i make it the default?

Thanks

Dave

Same problem as well. How to change the default certificate to point it to the new certificate?

Someone must have done this? or does everyone just live with the security warning when logging into an instant VC ?

Seems a little unprofessional to leave an install like this.

Dave

Same issue here, managed to upload the certificate.  But it isn't used by the web UI ?

How do you change the certificate binding ?

Also trying to do this... although I would at least like to generate a self-signed certificate - like every other vendor can do:

crypto ssl generate rsa 2048 location-ap-1.company.com (or something similar)

Why isn't this kind of thing available ?

Same problem here. I know how to create certificates, and I'm able to upload certificates through either the web UI or the CLI. I can get my certificate set as the "Current Server Certificate". But this certificate isn't the one used for the web management portal.

The self-signed certificate that is used (with CN = instant.arubanetworks.com) is not even listed in the "show cert all" command, which leads me to believe that no amount of tinkering with the cert commands will get this to work.

Is this a shortcoming (and security vulnerability) in the Aruba Instant OS?

I got it to work back in November of last year. The certificate needs to be a .pem file. Then upload the certificate to the aruba access point. Certificate Type: I choose Captive portal server.

I then open a internet browser and type the certificate name (That I created) in the url address bar, e.g. https://securelogin.comanyname.com

I'm not trying to change the captive portal certificate, I'm trying to change the virtual controller management UI certificate.

This is the certificate that is uploaded:

But this is the certificate that is served. This cert is not even listed in "show cert all".

ArubaOS/InstantOS 6.5.2, the first code which Unifies Instant and AOS will have the ability to upload and change the Certificate for the WEBUI.  

Is now released on the support.arubanetworks.com site..

Attachment(s)

Aruba Instant 6.5.2.0 Release Notes.pdf   164 KB 1 version

Was just able to roll to the 6.5.3.2 update, and am happy to confirm that this looks to be resolved. I was able to upload a concatenated cert+key via the IAP web UI's "Maintenance/Certificates" dialog for the "Web UI" target, and that certificate is now served for the management console on the Virtual Controller's vhost.

I would like to know also how to do this...

I have uploaded a server cert via GUI and even via AMP and i can´t use it , it always uses the default one when i connect to port 4343...

I have also tested uploading a CaptivePortal cert and it is uses if i connect to port 443.

Bonjour

J'ai également le problème de mon côté. C'est toujours le certificat par défaut qui est en pris en compte. Avez-vous une solution ?

Merci,