The Wiert Corner – irregular stream of stuff

Some links on Supermicro IPMI SSL because of SSL_ERROR_UNSUPPORTED_VERSION which can either mean your SuperMicro motherboard is too old to include newer TLS versions (X9 series and older motherboards; first try to upgrade firmware and BIOS; check supported TLS with [Wayback/Archive] /bin/bash based SSL/TLS tester: testssl.sh), or you misconfigured custom TLS certificates.

Some links:

• [Wayback/Archive] Supermicro IPMI SSL – Server Fault (thanks[Wayback/Archive] churnd and [Wayback/Archive] Rowan Hawkins)
  

  Q

  I have a Supermicro X9SCA-F serverboard and I’m trying to secure Super Doctor III IPMI by using SSL. I generated my own certs (done this many times before), uploaded via the web interface, then it said it needed to restart & I clicked OK, but it never came back up.

  A

  I wound up resetting the IPMI interface by downloading the IPMI tools for Linux from Supermicro’s website, making a bootable linux USB drive & copying the tools over to them, booting to it, & issuing ./ipmicfg-linux.x86.static -fd. This has to be done from the server/workstation directly.

  C

  Another trick if using the command line firmware update from a MS command prompt is to use the -C option which also resets it to factory. Just reapply the same version

• [Wayback/Archive] How to update Supermicro IPMI SSL Certificate on Linux – YouTube
  

  Walk through of how to update the IPMI SSL certificate on Linux. Here are the commands used in the video:

  openssl genrsa -out pvt.pem 2048

  openssl req -new -key pvt.pem -out crt.pem

  openssl x509 -req -days 3650 -in crt.pem -signkey pvt.pem -out crt.pem

• [Wayback/Archive] FAQ Entry | Online Support | Support – Super Micro Computer, Inc.
  

  Q

  We have X9 motherboard and did security scan on it, discovered SSL version 2 and 3 detected. SSLv3 Poodle vulnerability. SSL RC4 Cipher Suites (bar mitzvah vulnerability) discovered.

  A

  Please make sure you have latest IPMI firmware version.

  RC4 is disabled since 3.28

  SSL v2 is disabled since 1.84

  SSL v3 is disabled since 3.36

  The customer may try the oem cmd 0x30 0x70 0xb7 to remove lighttpd.conf

• [Wayback/Archive] tls – trying to make a secure connection to a website, I get the error “ERR_SSL_VERSION_OR_CIPHER_MISMATCH” – Super User

Queries:

• [Wayback/Archive] supermicro ERR_SSL_VERSION_OR_CIPHER_MISMATCH – Google Search.
• [Wayback/Archive] err_ssl_version_or_cipher_mismatch – Google Search
• [Wayback/Archive] testssl sh ERR_SSL_VERSION_OR_CIPHER_MISMATCH – Google Search

–jeroen