HP ProCurve Crypto PKI: How to Enroll a Self-Signed…

KEY TAKEAWAYS

1. HP ProCurve switches use the crypto PKI command set to generate and enroll self-signed certificates that enable HTTPS management access and secure communications.
2. Newer Aruba AOS-S firmware uses the crypto pki enroll-self-signed syntax, while older ProCurve firmware relies on the crypto host-cert generate self-signed command format.
3. Certificate enrollment supports both RSA key types with 1024 or 2048-bit sizes and ECDSA key types with 256 or 384-bit curve sizes for cryptographic flexibility.
4. Self-signed certificates work immediately for HTTPS management but trigger browser security warnings because no external Certificate Authority validates the certificate's identity chain.
5. The enrollment process requires clearing existing certificates first with the crypto pki zeroize command before generating new certificates to avoid configuration conflicts on the switch.

Network administrators managing HP ProCurve and Aruba switches need encrypted HTTPS connections to protect management traffic from interception across enterprise networks. The crypto PKI command set built into these switches provides the tools to generate self-signed certificates directly on the device without requiring an external Certificate Authority (CA) infrastructure.Self-signed certificates enable immediate HTTPS access for switch management while avoiding the complexity and cost of deploying a full Public Key Infrastructure (PKI) environment across the network. This approach suits lab environments, branch offices, and smaller deployments where certificate authority overhead exceeds practical security requirements.This guide covers the complete enrollment process for both current Aruba AOS-S firmware and older ProCurve firmware versions, including key generation, certificate creation, SSL activation, and common troubleshooting steps.

Prerequisites and Command Set Identification

Before starting the certificate enrollment process, administrators must identify which command syntax their switch firmware supports because HP changed the PKI commands across firmware generations. Newer Aruba AOS-S firmware versions, including those running on 2530, 2540, 2930F, and 5400R series switches, use the crypto pki command family with structured parameter syntax.Older ProCurve firmware versions running on legacy hardware use the crypto host-cert command family with positional parameters for certificate subject fields. Console access through a USB adapter and terminal software such as PuTTY provides the most reliable connection method for initial certificate configuration work.Administrators should verify their current firmware version by running the show version command before proceeding with certificate enrollment to ensure they use the correct syntax. Running the wrong command set produces errors that can leave the switch in a state where neither HTTP nor HTTPS management access functions correctly.The Trust Anchor Profile name can contain up to 100 characters, and available usage types include web management, OpenFlow, captive portal, syslog, and radsec-client, depending on the intended application. Setting the usage parameter to "all" enables the certificate across web applications, OpenFlow, syslog, and additional supported services simultaneously.

Step-by-Step Self-Signed Certificate Enrollment

Here's a step-by-step guide that walks you through creating and enrolling a self-signed certificate.

Step 1: Clear Existing Certificates

Enter configuration mode and remove any previously installed certificates to prevent conflicts during the new enrollment process. On newer firmware, run the command: crypto pki zeroize. On older ProCurve firmware, use: crypto host-cert zeroize. This step removes all existing certificate material from the switch's certificate store and resets the PKI configuration to a clean baseline state.

Step 2: Generate the RSA Key Pair

If the switch displays RSA certificate errors during enrollment, generate the RSA key pair manually before creating the certificate itself. Run: crypto key generate cert.The AOS-S documentation confirms that this command installs an RSA key for the HTTPS certificate, with 1024 or 2048-bit sizes supported and 1024 as the default. ECDSA keys are generated as part of the enroll-self-signed command rather than through crypto key generate cert.

Step 3: Create the Self-Signed Certificate

On the current Aruba AOS-S firmware, the enrollment command follows this structured syntax: crypto pki enroll-self-signed certificate-name [NAME] key-type rsa key-size [1024|2048] subject common-name [CN] ... valid-start [mm/dd/yyyy] valid-end [mm/dd/yyyy]. For ECDSA certificates, use the separate syntax: crypto pki enroll-self-signed certificate-name [NAME] key-type ecdsa curve [256|384] subject common-name [CN] ... valid-start [mm/dd/yyyy] valid-end [mm/dd/yyyy].Optional subject fields include organization, organizational unit, locality, state, and country code parameters that populate the certificate's distinguished name.On older ProCurve firmware, the command uses positional parameters: crypto host-cert generate self-signed [start-date] [end-date] [common-name] [org-unit] [org-name] [city] [state] [country-code]. The date format across both command sets requires mm/dd/yyyy formatting, and the HPE documentation notes that including subject fields will override any previously configured identity profile on the switch.On current AOS-S firmware, valid-start and valid-end should appear within the subject parameter block in the order shown in the HPE documentation.

Step 4: Enable SSL and Configure Web Management

After certificate creation completes successfully, enable SSL for web management access by entering configuration mode and running: web-management ssl. This command activates HTTPS on the switch's management interface using the newly enrolled certificate for all incoming secure connections.Optionally disable plaintext HTTP access by running: no web-management plaintext. This forces all management connections through encrypted HTTPS, which prevents credential interception but requires maintaining console access as a fallback if the certificate expires or SSL configuration encounters problems.

Step 5: Save the Configuration

Run: write mem to save the certificate and SSL configuration to persistent storage. Without this step, a switch reboot would discard the certificate enrollment and revert to the previous configuration state. Verify the certificate installation by connecting to the switch's IP address over HTTPS in a web browser.

Troubleshooting Common Certificate Enrollment Issues

Browser security warnings appear when connecting to switches using self-signed certificates because no external Certificate Authority has validated the certificate's identity chain. This behavior is expected and does not indicate a configuration error; administrators can add a browser exception or deploy a CA-signed certificate for production environments.If HTTP access is disabled and the HTTPS connection fails due to certificate problems, console access through the serial port provides the recovery path. Re-enable HTTP temporarily with: web-management plaintext to restore management connectivity while diagnosing the certificate or SSL configuration problem.Certain switch models may not support specific cipher suites, which causes HTTPS handshake failures with modern browsers that require Transport Layer Security (TLS) 1.2 or higher.Identity profile conflicts can occur when the enrollment command's subject fields override a previously configured identity profile on the switch. The HPE technical documentation confirms that explicitly including subject parameters during enrollment will override the configured identity profile, which may affect other PKI-dependent features on the device.

Regulatory Implications

Organizations subject to compliance frameworks, including Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act (HIPAA), and Service Organization Control 2 (SOC 2), must encrypt network management traffic. Self-signed certificates satisfy the encryption requirement but may not meet audit standards that mandate CA-signed certificates with documented certificate lifecycle management.

What's Next?

Organizations scaling beyond self-signed certificates should evaluate Enrollment over Secure Transport (EST) or SCEP integration for centralized certificate provisioning and lifecycle management across their switch fleet.

FAQs

What is crypto PKI on HP ProCurve switches? Crypto PKI is the command set on HP ProCurve and Aruba switches that manages digital certificates for enabling encrypted HTTPS management access and other secure communications.Can I use a self-signed certificate for production switches? Self-signed certificates provide encryption but trigger browser warnings and may not satisfy compliance audits requiring CA-signed certificates with documented certificate lifecycle management procedures in place.What key sizes does HP ProCurve support for certificates? HP ProCurve supports RSA keys at 1024 or 2048-bit sizes with 1024 as the default, and ECDSA keys at 256 or 384-bit curve sizes with 256 as the default.What happens if my self-signed certificate expires? An expired certificate causes HTTPS connections to fail with browser errors, requiring console access to generate and enroll a new certificate before restoring web management functionality.How do I remove an existing certificate from the switch? Run crypto pki zeroize on newer Aruba firmware or crypto host-cert zeroize on older ProCurve firmware to clear all certificate material and reset the PKI configuration completely.What is the difference between crypto host-cert and crypto pki? Crypto host-cert is the legacy command set used on older ProCurve firmware, while crypto pki is the current command family used on Aruba AOS-S firmware versions.Does the self-signed certificate enable HTTPS automatically? Creating the certificate does not automatically enable HTTPS; administrators must separately run the web-management ssl command and optionally disable plaintext HTTP access on the switch.

References

1. Aruba AOS-S 16.10: Create and Enroll a Self-Signed Certificate
2. Aruba AOS-S: Self-Signed Certificate Enrollment
3. Accept Defaults: Creating a Self-Signed Certificate on ProCurve (Aruba) Switches
4. HPE Community: HP 2530 Crypto PKI Command Discussion