The certificate used by Ironic as part of the metal3 deployment uses "metal3-ironic" as CN, which does not correspond to the hostname in the cluster. This creates trouble for the TLS validation in some BMCs.

    Seen on OCP 4.12 and later versions.

    Always

    1. openssl s_client -showcerts <hostname>:6385 < /dev/null     
    2. Check subject CN
    

    Two CNs are shown: localhost and metal3-ironic

    The CN can be configurable, so it is accepted by the BMC