If receiving error during the pre-upgrade check (upgrading to 8.0) and currently using Sectigo custom SSL certs, the steps contained in this article will assist in properly removing the certs, and then create new signing (chain) cert to be used, not including the old Comodo SHA1 cert in chain.
"Error Support for certificates with weak signature algorithms has been removed in vCenter Server 8.0. The certificate with subject '/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' in VECS store TRUSTED_ROOTS has weak signature algorithm sha1WithRSAEncryption. Replace the certificate with subject '/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' in VECS store TRUSTED_ROOTS with a certificate that uses the SHA-2 signature algorithm. Caution: Verify that any certificates signed by the problematic certificate are not in use by vCenter Server. Refer to the vCenter Server release notes and VMware KB 89424 for more details."
This error indicates the Sectigo signing (chain) cert contains an old SHA1 cert that is not supported by vSphere 8.
NOTE:
The below commands are specific to the scenario faced. The "--id
" value may differ between environments.
===============================================================
/usr/lib/vmware-vmafd/bin/dir-cli trustedcert get --id 5379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB --login [email protected] --outcert /tmp/oldcert1.cer
/usr/lib/vmware-vmafd/bin/dir-cli trustedcert get --id A0110A233E96F107ECE2AF29EF82A57FD030A4B4 --login [email protected] --outcert /tmp/oldcert2.cer
===============================================================
/usr/lib/vmware-vmafd/bin/dir-cli trustedcert unpublish --cert /tmp/oldcert1.cer
/usr/lib/vmware-vmafd/bin/dir-cli trustedcert unpublish --cert /tmp/oldcert2.cer
===============================================================
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store TRUSTED_ROOTS --alias d89e3b43d5d909b47a18977aa9d5ce36cee104c
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store TRUSTED_ROOTS --alias d1eb23a46d17d68fd92564c2f1f1601764d8e349
===============================================================
SHA1, Sectigo, signing chain, upgrade to vCenter 8
Impact/Risks:
Steps will involve replacing current custom VCSA Machine cert with default self-signed cert, and then remove current Sectigo signing certs from Trusted Root store.