Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #273200 > unrolled thread

How to generate a certificate for an HP printer?

Back to article view | Back to linux.debian.user

Contents

  How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-21 23:30 +0200
    Re: How to generate a certificate for an HP printer? Jeffrey Walton <noloader@gmail.com> - 2024-09-21 23:40 +0200
      Re: How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-22 05:00 +0200
    Re: How to generate a certificate for an HP printer? "Alexander V. Makartsev" <avbetev@gmail.com> - 2024-09-22 10:10 +0200
    Re: How to generate a certificate for an HP printer? john doe <johndoe65534@mail.com> - 2024-09-22 16:00 +0200
      Re: How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-22 17:10 +0200
        Re: How to generate a certificate for an HP printer? john doe <johndoe65534@mail.com> - 2024-09-22 18:10 +0200
          Re: How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-22 19:10 +0200
          Re: How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-22 21:10 +0200
            Re: How to generate a certificate for an HP printer? john doe <johndoe65534@mail.com> - 2024-09-22 21:40 +0200
            Re: How to generate a certificate for an HP printer? Jeffrey Walton <noloader@gmail.com> - 2024-09-23 00:00 +0200
              Re: How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-23 04:00 +0200
            Re: How to generate a certificate for an HP printer? Charles Curley <charlescurley@charlescurley.com> - 2024-09-23 04:10 +0200
              Re: How to generate a certificate for an HP printer? Jeffrey Walton <noloader@gmail.com> - 2024-09-23 05:30 +0200
            Re: How to generate a certificate for an HP printer? Max Nikulin <manikulin@gmail.com> - 2024-09-23 04:20 +0200

#273200 — How to generate a certificate for an HP printer?

I have an HP LaserJet MFP M234sdw printer. I am getting error messages
from CUPS that say something like "cups-pki expired". The certificate
on the printer expired recently.

How do I generate a signed certificate to use in the printer?

There is no mechanism to do so in the printer's firmware.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [next] | [standalone]

#273201

On Sat, Sep 21, 2024 at 5:26 PM Charles Curley
<charlescurley@charlescurley.com> wrote:
>
> I have an HP LaserJet MFP M234sdw printer. I am getting error messages
> from CUPS that say something like "cups-pki expired". The certificate
> on the printer expired recently.
>
> How do I generate a signed certificate to use in the printer?
>
> There is no mechanism to do so in the printer's firmware.

You install certificates from the printer's web administration page.
<https://support.hp.com/my-en/document/ish_4629366-5428336-16>.

If you want to run your own PKI, then checkout Dogtag,
<https://www.dogtagpki.org/>.

Jeff

[toc] | [prev] | [next] | [standalone]

#273202

On Sat, 21 Sep 2024 17:34:51 -0400
Jeffrey Walton <noloader@gmail.com> wrote:

> > How do I generate a signed certificate to use in the printer?
> >
> > There is no mechanism to do so in the printer's firmware.  
> 
> You install certificates from the printer's web administration page.
> <https://support.hp.com/my-en/document/ish_4629366-5428336-16>.

Nope. There is no certificate generator on the printer, and that page
doesn't describe the web navigation correctly.

> 
> If you want to run your own PKI, then checkout Dogtag,
> <https://www.dogtagpki.org/>.

I'll look into this, thanks. I am, however, a certificate illiterate.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#273204

[Multipart message — attachments visible in raw view] — view raw

On 22.09.2024 02:25, Charles Curley wrote:
> I have an HP LaserJet MFP M234sdw printer. I am getting error messages
> from CUPS that say something like "cups-pki expired". The certificate
> on the printer expired recently.
>
> How do I generate a signed certificate to use in the printer?
>
> There is no mechanism to do so in the printer's firmware.
>
You can use "easy-rsa" package to create private Certificate Authority 
(CA) and generate signed certificates.
It is a collection of openssl wrapper scripts and is quick and simple to 
use.

-- 

  With kindest regards, Alexander.

  Debian - The universal operating system
  https://www.debian.org

[toc] | [prev] | [next] | [standalone]

#273206

On 9/21/24 23:25, Charles Curley wrote:
> I have an HP LaserJet MFP M234sdw printer. I am getting error messages
> from CUPS that say something like "cups-pki expired". The certificate
> on the printer expired recently.
>

Is it a selfsigned cert?

> How do I generate a signed certificate to use in the printer?
>
> There is no mechanism to do so in the printer's firmware.
>

Even if you upgrade the FW?

--
John Doe

[toc] | [prev] | [next] | [standalone]

#273207

On Sun, 22 Sep 2024 15:54:09 +0200
john doe <johndoe65534@mail.com> wrote:

> On 9/21/24 23:25, Charles Curley wrote:
> > I have an HP LaserJet MFP M234sdw printer. I am getting error
> > messages from CUPS that say something like "cups-pki expired". The
> > certificate on the printer expired recently.
> >  
> 
> Is it a selfsigned cert?

I think so. The embedded web server says,

   By default, a pre-installed self-signed printer certificate is
   created to identify this printer. You can change this certificate to
   more accurately identify the printer and to update the length of
   time the certificate is valid.

> 
> > How do I generate a signed certificate to use in the printer?
> >
> > There is no mechanism to do so in the printer's firmware.
> >  
> 
> Even if you upgrade the FW?

I tried upgrading the firmware. I have the latest available, 20201215.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#273208

On 9/22/24 17:05, Charles Curley wrote:
> On Sun, 22 Sep 2024 15:54:09 +0200
> john doe <johndoe65534@mail.com> wrote:
>
>> On 9/21/24 23:25, Charles Curley wrote:
>>> I have an HP LaserJet MFP M234sdw printer. I am getting error
>>> messages from CUPS that say something like "cups-pki expired". The
>>> certificate on the printer expired recently.
>>>
>>
>> Is it a selfsigned cert?
>
> I think so. The embedded web server says,
>
>     By default, a pre-installed self-signed printer certificate is
>     created to identify this printer. You can change this certificate to
>     more accurately identify the printer and to update the length of
>     time the certificate is valid.
>
>>
>>> How do I generate a signed certificate to use in the printer?
>>>
>>> There is no mechanism to do so in the printer's firmware.
>>>
>>
>> Even if you upgrade the FW?
>
> I tried upgrading the firmware. I have the latest available, 20201215.
>

I also have a HP.
After entering credentials it allows me to access the advance
capabilities of my printer.
It allows me among other things to renew the selfsigned cert!

To me, this is build-in! ;^)

--
John Doe

[toc] | [prev] | [next] | [standalone]

#273210

On Sun, 22 Sep 2024 18:02:30 +0200
john doe <johndoe65534@mail.com> wrote:

> I also have a HP.
> After entering credentials it allows me to access the advance
> capabilities of my printer.

What credentials? I have a user name and password (which I changed from
the defaults), and have used those to log in. Is there some other set
of credentials I have missed?

> It allows me among other things to renew the selfsigned cert!
> 
> To me, this is build-in! ;^)



-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#273215

On Sun, 22 Sep 2024 18:02:30 +0200
john doe <johndoe65534@mail.com> wrote:

> >> Even if you upgrade the FW?  
> >
> > I tried upgrading the firmware. I have the latest available,
> > 20201215. 
> 
> I also have a HP.
> After entering credentials it allows me to access the advance
> capabilities of my printer.
> It allows me among other things to renew the selfsigned cert!
> 
> To me, this is build-in! ;^)

I did finally find it.

Networking -> Certificates -> Configure

That gives me several options. I then selected "Create a New
Self-Signed Certificate". That updated the certificate. I now cannot
print on that printer, even after cycling power. If I print over the USB
interface, I hear it spin its wheels, but nothing is printed. I tried
deleting and re-installing it. No go.

Or I could select "Create a Certificate Request" and hit Next. I filled
in the details, hit Next. No complaints from the printer. I then used
copy and paste to save off the cert request. This is a good thing,
because when I hit "Save" I got several requests for Username and
Password in a row. I gave up after the 5th such request.

I'm rather frustrated and annoyed.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#273216

On 9/22/24 21:02, Charles Curley wrote:
> On Sun, 22 Sep 2024 18:02:30 +0200
> john doe <johndoe65534@mail.com> wrote:
>
>>>> Even if you upgrade the FW?
>>>
>>> I tried upgrading the firmware. I have the latest available,
>>> 20201215.
>>
>> I also have a HP.
>> After entering credentials it allows me to access the advance
>> capabilities of my printer.
>> It allows me among other things to renew the selfsigned cert!
>>
>> To me, this is build-in! ;^)
>
> I did finally find it.
>
> Networking -> Certificates -> Configure
>
> That gives me several options. I then selected "Create a New
> Self-Signed Certificate". That updated the certificate. I now cannot
> print on that printer, even after cycling power.

Do you realy need SSL/TLS for a printer, if your network is secured.

> If I print over the USB
> interface, I hear it spin its wheels, but nothing is printed. I tried
> deleting and re-installing it. No go.
>
> Or I could select "Create a Certificate Request" and hit Next. I filled
> in the details, hit Next. No complaints from the printer. I then used
> copy and paste to save off the cert request. This is a good thing,
> because when I hit "Save" I got several requests for Username and
> Password in a row. I gave up after the 5th such request.
>
> I'm rather frustrated and annoyed.
>

A wild guess, would be that the default cert was signed by a trusted CA,
which could explain why it was working out of the box! ;^)

You could use Letsencrypt to sign your CSR, assuming that you can upload
your signed cert to the printer.

I can access my printer via telnet, which is, sometime less frustrating! ;^)

Good luck I guess!

--
John Doe

[toc] | [prev] | [next] | [standalone]

#273217

On Sun, Sep 22, 2024 at 3:02 PM Charles Curley
<charlescurley@charlescurley.com> wrote:
>
> On Sun, 22 Sep 2024 18:02:30 +0200
> john doe <johndoe65534@mail.com> wrote:
>
> > >> Even if you upgrade the FW?
> > >
> > > I tried upgrading the firmware. I have the latest available,
> > > 20201215.
> >
> > I also have a HP.
> > After entering credentials it allows me to access the advance
> > capabilities of my printer.
> > It allows me among other things to renew the selfsigned cert!
> >
> > To me, this is build-in! ;^)
>
> I did finally find it.
>
> Networking -> Certificates -> Configure

Interesting. Previously you said, "Nope. There is no certificate
generator on the printer [web admin page],.."

> That gives me several options. I then selected "Create a New
> Self-Signed Certificate". That updated the certificate. I now cannot
> print on that printer, even after cycling power. If I print over the USB
> interface, I hear it spin its wheels, but nothing is printed. I tried
> deleting and re-installing it. No go.

Use IPP printing. The connection on your workstation will be something
like <ipp://colorlaserjet.home.arpa>.

> Or I could select "Create a Certificate Request" and hit Next. I filled
> in the details, hit Next. No complaints from the printer. I then used
> copy and paste to save off the cert request. This is a good thing,
> because when I hit "Save" I got several requests for Username and
> Password in a row. I gave up after the 5th such request.

Jeff

[toc] | [prev] | [next] | [standalone]

#273221

On Sun, 22 Sep 2024 17:56:56 -0400
Jeffrey Walton <noloader@gmail.com> wrote:

> >
> > Networking -> Certificates -> Configure  
> 
> Interesting. Previously you said, "Nope. There is no certificate
> generator on the printer [web admin page],.."

Yes, I did. I don't know why I didn't try the Configure button.

One reason I described the path to the correct place above is that the
various pages I found in HP's mess of documentation all provided
different paths, none of which were this one.

> Use IPP printing. The connection on your workstation will be something
> like <ipp://colorlaserjet.home.arpa>.

That is indeed the approach I am now taking.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#273222

On Sun, 22 Sep 2024 13:02:26 -0600
Charles Curley <charlescurley@charlescurley.com> wrote:

> If I print over the USB
> interface, I hear it spin its wheels, but nothing is printed. I tried
> deleting and re-installing it. No go.

I finally solved that one. I changed the driver for the printer. It
used to work correctly.

In other news, I finally got printing from another machine running.
I use IPP to the desktop (which has the printer on a USB cable). This
involved opening both IPP and IPP-client in the firewalls of both the
server and the client. The two printers that magically appear thanks to
Avahi/Bonjour are still useless.

None of these solutions involve using the cert. That does affect the
embedded web server. Since it is self-signed, I still have to jump
through a hoop to get to it. Sigh.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#273224

On Sun, Sep 22, 2024 at 10:03 PM Charles Curley
<charlescurley@charlescurley.com> wrote:
>
> On Sun, 22 Sep 2024 13:02:26 -0600
> Charles Curley <charlescurley@charlescurley.com> wrote:
>
> > If I print over the USB
> > interface, I hear it spin its wheels, but nothing is printed. I tried
> > deleting and re-installing it. No go.
>
> I finally solved that one. I changed the driver for the printer. It
> used to work correctly.
>
> In other news, I finally got printing from another machine running.
> I use IPP to the desktop (which has the printer on a USB cable). This
> involved opening both IPP and IPP-client in the firewalls of both the
> server and the client. The two printers that magically appear thanks to
> Avahi/Bonjour are still useless.

I disable most print services, like Bonjour and 9100 printing. I run
my own DNS locally, and it is the source of truth for my network. In
fact, I remove the packages that provide services like Bonjour and
mDNS (when I can). Here's what my Network Config page looks like:
<https://ibb.co/1qg2HX7>.

> None of these solutions involve using the cert. That does affect the
> embedded web server. Since it is self-signed, I still have to jump
> through a hoop to get to it. Sigh.

You can install a self-signed certificate in your browser's
certificate store, and you will not have to deal with the prompts.

Jeff

[toc] | [prev] | [next] | [standalone]

#273223

On 23/09/2024 02:02, Charles Curley wrote:
> Networking -> Certificates -> Configure
> 
> That gives me several options. I then selected "Create a New
> Self-Signed Certificate". That updated the certificate. I now cannot
> print on that printer,

It is expected. Why your system should trust some new (and thus unknown) 
certificate having unclear origin?

> Or I could select "Create a Certificate Request" and hit Next.

This option is for admins running local Certificate Authority. 
Certificate request must be signed by some Certificate Authority and you 
need to have the root certificate of that Certificate Authority 
installed on your machine.

> I'm rather frustrated and annoyed.

Seek for CUPS docs how to install a self-signed certificate that you may 
obtain from your printer.

For system-wide certificate management see
/usr/share/doc/ca-certificates/README.Debian

Perhaps you might disable TLS in your printer configuration, but I have 
no idea what degree of security you wish to have.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web