Adding Sure Admin secrets to the Vault HP Sure Admin required certificates which must be provided. HP Connect will read the certificates and obtain the embedded private/public keys to configure HP Sure Admin. These cryptographic keys are then used when creating BIOS authentication policies, and to authorize (sign) BIOS settings changes. Appendix A provides additional details on HP Sure Admin, and illustrates a step-step process for creating the required certificates (examples provided using OpenSSL). To add a HP Sure Admin secret that will later be provisioned by policy to HP devices, follow these steps:
From the dashboard, select the Secrets sidebar tab and then select New Secret , or click on New Secret on the home page. In the Secret Information page fill in the following fields o Name It is useful to identify the purpose of the secret as part of the name o Type - select ‘ Certificate ’ from dropdown o Certificate Type – select either Select ‘ Secure Platform Management ‘ The Secure Platform Management secret will help set up the trusted firmware environment required to enable HP Sure Admin, and for other future HP BIOS security needs or Local Access’ An Individual secret will be used to allow secure access to the F10 BIOS Setup on a device.
This is the LAK (Local Access Key) o Description – free format field o Tags – type a tag name and click Add Tag. Add as many tags as desired o Endorsement Key – the certificate in pfx format described in Appendix A o Signing Key – the certificate in pfx format described in Appendix A Click Save Page 14 September 27, 2022 Version 1.2.0 © 2022 HP Development Company, L.P. The information contained herein is subject to change without notice.