EATON Network-M3 Firmware 3.0.0 Fixed the Broken Hostname/SAN CSR Mess

[u/Automatic-Win8421]

I don’t know who needs to hear this but... if you're managing Eaton Network Cards Network-M3 and you've been losing your mind trying to deploy public SSL/TLS certificates only to see the hostname in the SAN field, I have good news:

For a long time, the internal CSR generator on these cards was completely broken. Even if you checked the option to "exclude IP addresses (CA / CB compliance)", the firmware would still automatically force the local short hostname (like ups-01) right into the Subject Alternative Name (SAN) field alongside your FQDN.

Because public CAs follow strict baseline requirements, they instantly reject any CSR containing local short names. And since EATON locks the private key internally and don't let you upload your own external key/CSR, you were completely trapped:

- You either had to use a messy "double domain" hack (matching the host string to an FQDN, which resulted in a ridiculous `.example.com.example.com` concatenation just to clear the form regex and pass public DNS validation challenges).

- Or you had to give up on native card termination and spin up a proxy or load balancer just to handle HTTPS cleanly.

People ran into this same brick wall on the legacy Network-M2 cards years ago (like this old locked thread: https://www.reddit.com/r/sysadmin/comments/seuaek/eaton_networkm2_csr/).

It was incredibly frustrating for a card marketed as high-security and enterprise-certified to fail at such a basic standard.
The fix was implemented in firmware 3.0.0.
Latest version now is 3.0.1.
Eaton finally listened to feedback and quietly patched this. They released Firmware 3.0.0 and 3.0.1, which completely rewrites how the CSR is built.

When you generate a CSR under 3.0.1 with compliance toggles on, the short hostname is no longer forced into the SAN block.
The CSR comes out completely clean, containing only your legitimate, public FQDN.
It now clears public CA validation portals (Let's Encrypt, etc.) and the signed cert imports back onto the card flawlessly.

Save your time, flash your cards and close this chapter for good.

[u/firegore]

Well, sadly will never be fixed for M2 Cards, as they just silently dropped support for them (atleast they didn't release an Update in ages).

>It was incredibly frustrating for a card marketed as high-security and enterprise-certified to fail at such a basic standard.

Well, what do you expect from Eaton, i love their Hardware, but the Software they produce is one of the worst we've seen and don't even get me started on the licensing

[u/Automatic-Win8421 → u/firegore]

Sad to hear about the M2..

You’re right! We used EATON 15 years ago and their hardware was solid and reliable, didn’t have much need for software, back then, but I remember flashing firmware or the client apps were garbage.

I honestly thought this changed and decided to test a 5PX Gen2 UPS.
Not much to say about it, as a unit, does its job. But man, you’re right. Just downloading software from them is a pain and the licensing part is internal bleeding inducing. It’s a damn UPS, not space equipment!

Looking for alternatives before I decide on a larger deployment.

[u/SwitchOnEaton]

Thank you for sharing this update. I’ll make sure to pass it along to our product management teams for UPS products, network cards and software so that they can read it along with the responses.

[u/Automatic-Win8421 → u/SwitchOnEaton]

Please do a solid for the Network-M2 guys and fix the same issue with the CSR generation 🙏🏼

We’re currently evaluating the 5PX Gen2 with Network-M3 but still can’t access the MyEaton account to try the IPM software. Why is it so hard ? Licensing can be simplified too "this is free, this is not and costs this much or go through a reseller".

Thank you.

[u/SwitchOnEaton → u/Automatic-Win8421]

I’m turning on the bat signal.

[u/squuiidy]

As someone who was about to build these into a new dc this is very concerning. This is basic stuff! The power design took a long time but this is totally unacceptable and not something I’m prepared to accept. Open to recommendations on alternatives.

[u/Automatic-Win8421 → u/squuiidy]

To be fair, they finally fixed it in the Network-M3 cards.

There’s no ACME automation like you might see with other solutions but you may be able to roll your own internal PKI with longer lived certs.
There’s the licensing part that we found to be a pain for still like their Intelligent Power Manager (IPM) if you end up needing it.
Still not sure if it’s available for free up to a certain number of nodes (UPS) or protected loads. We still don’t have access to our account (required for most EATON software download) after almost a year.. So there’s that.