This is maddeningly stupid on Supermicro's part. Why they couldn't just let it use the internal certificate that can be uploaded by the sysadmin is beyond me.
I was able to get around this issue by doing the following...
- In the IPMI web gui go to Configuration > Date and Time and set the local IPMI clock to some time before mid-May 2026 when the burned in certificate expires.
- Prepare your local PC's Java to run the jnlp. You might have already gone through these steps if you used it previously...
- I don't know if the following items are really all that necessary, but I got them from a chatbot and they seem to help bypass the Java warnings for me.
- In the file C:\Users\<user>\AppData\LocalLow\Sun\Java\Deployment\deployment.properties I have these set...
- deployment.security.revocation.check=NO_CHECK
- deployment.security.askgrantdialog.show=false
- deployment.security.validation=off
- deployment.security.mixcode=DISABLE
- Additionally, in C:\Users\<user>\AppData\LocalLow\Sun\Java\Deployment\security\exception.sites I have the HTTP/HTTPS URL of the IPMI interface added to the security exceptions list.
- Download the jnlp file from the web interface as normal.
- Use PsSuspend or Process Explorer from the Sysinternals toolkit to suspend the jp2launcher.exe process that launches when opening the jnlp file. You'll want to do this quickly after launching, after the connection attempts start but before the failure dialog presents.
- The reason for doing this is to give you time to perform the following steps. Things happen too quickly if you don't suspend the process.
- Find the stunnel program that has launched in the system tray. Go to Configuration > Edit. In the text file, change any "verify = 3" lines you see to "verify = 0". Save and exit the text editor.
- Go to Configuration > Reload to reload the changed settings into stunnel.
- Un-suspend/Resume the jp2launcher.exe program that you suspended. It should make another connection attempt and succeed, showing the IPMI display console.
Hopefully these steps work for you as well. Unfortunately, the stunnel program and config files are located in a temp directory and re-created at each launch, so you'll need to do this shenanigans each time. But, it prevents you from having to change your PC time and is pretty quick when you get the hang of it.
