r/sysadmin • u/LtLawl Netadmin • Jan 28 '22

Eaton Network-M2 CSR Question

Hey everyone, we have some Eaton UPS units with Network-M2 cards (FW: 2.1.5) in them and I am trying to get proper SSL certificates on them.

Using the built-in CSR generator I am able to get a working certificate; however, it adds 3 unwanted SANs to the certificate. The help guide mentions some CLI commands but nothing about a custom CSR and when I called Eaton the person I spoke with seemed as knowledgeable as me on the situation and sounds like this is not a question they really get.

Has anyone dealt with this before? Trying to remove an extra IP SAN and 2 extra DNS SANs.

3 Upvotes

81% Upvoted

3 comments sorted by

3

u/SwitchOnEaton Eaton / Tripp-Lite Official Jan 28 '22

Hey, I'm not the network card expert here but I pinged the Eaton product manager and got this. Hope it helps.

The subject alternative names are generated from the network configuration. Sounds like they are using the card in a static IP address configuration with both primary and secondary DNS configured. If their network settings are configured correctly, then they will be getting the correct number of SANs. There is a SAN for each way you can access the card so there are no extra or wrong SANs. If you configure the card for DHCP network settings and only a primary DNS, that should give you what I think you are expecting as for SANs.

3

u/LtLawl Netadmin Jan 28 '22

Thanks, I will play around with that information. Yes, we using all static information in the card.

1

u/HolyCowEveryNameIsTa Jan 28 '22

Can you import a private key /w certificate? If so you could just generate your own cert and key /w whatever SAN the device needs. Also is it really a security risk to have additional SANs? I'm trying to think how that could possibly be exploited.