Open Ticket

The Supermicro iKVM uses a TLS client/server certificate pair embedded in the BMC firmware. On the affected models/firmwares, this pair was issued in 2016 with a fixed 10-year validity period and expired on 2026-05-17. The problem is not related to Tenantos or to any change on our side.

The iKVM connection uses mutual TLS, so the expired certificate is checked twice. The Java KVM viewer, more specifically the spawned stunnel process, verifies the BMC server certificate and the BMC independently validates the client certificate against its own clock. Therefore this cannot be solved by client-side measures alone (e.g. only changing the client date).

If the automatic handling does not resolve the issue for a given server, the options are:

• Install a Supermicro BMC firmware update, if one is available for that model. Updated firmware often ships with a new certificate.
• Set the date in the IPMI/BMC to a date before 2026-05-17 (for example 2023), and enable the "Fake Date" option on the IPMI connection in Tenantos. Both are required together because of the mutual TLS double check described above.