HP Integrated Lights-Out 2 User Guide

• Import Certificate—Use this button when you are returning to the Certificate Administration pagewith a certificate to import. Click Import Certificate to go directly to the Certificate Import screenwithout generating a new CR. A given certificate only works with the keys generated for the originalCR from which the certificate was generated. If the iLO 2 has been reset or another CR has beengenerated since the original CR was submitted to a CA, then a new CR must be generated andsubmitted to the CA.You can create a CR or import an existing certificate using RIBCL XML commands. These commandsenable you to script and automate certificate deployment on iLO 2 servers instead of manually deployingcertificates through the browser interface. For more information, see "CERTIFICATE_SIGNING_REQUEST"and "IMPORT_CERTIFICATE" in the "Remote Insight Command Language" section of the HP IntegratedLights-Out Management Processor Scripting and Command Line Resource Guide.CERTIFICATE_SIGNING_REQUEST and IMPORT_CERTIFICATE cannot be used with the standardCPQLOCFG utility. However, you can use the PERL version of CPQLOCFG in combination with thesecommands.Two-factor authenticationiLO 2 is a powerful tool for managing HP ProLiant servers. To prevent misuse of this tool, access to iLO 2requires reliable user authentication. This firmware release provides a stronger authentication scheme foriLO 2 using two factors of authentication: a password or PIN and a private key for a digital certificate.Using two-factor authentication requires users to verify their identities by providing both factors. Users canstore their digital certificates and private keys wherever they choose, for example, smart card, USB token,or hard disk.The Two-Factor Authentication tab in the Security section enables you to configure security settings andreview, import, and delete a trusted CA certificate.The Two-Factor Authentication Enforcement setting controls whether two-factor authentication is used foruser authentication during login. To require two-factor authentication, click Enabled. To turn off the twofactorauthentication requirement and allow login with user name and password only, click Disabled.You cannot change the setting to Enabled if a trusted CA certificate is not configured. To provide theConfiguring iLO 2 38