Creating a Microsoft Certificate Authority Template to create SSL certificate for use in vSphere

Products

• VMware vCenter Server

Issue/Introduction

This article details the configuration of Microsoft Certificate Authority (CA) templates necessary for implementing custom SSL certificates within a vSphere environment.

Environment

VMware vCenter Server 8.0.x

Resolution

The process involves creating and making available two different custom Microsoft CA templates:

• One for the Machine SSL and Solution User certificates
• One for for the VMCA root certificate, when using VMCA as a Subordinate CA.

Creating a template for the Machine SSL and Solution User Certificates

This template is for certificates used by vSphere components like the Machine SSL certificate and Solution User certificates.

1. Connect to the CA server via RDP.
2. Open the Certificate Template Console by clicking Start → Run, then enter certtmpl.msc and confirm by clicking OK.
3. Right-click the Web Server template and select Duplicate Template.
4. In the Duplicate Template window, select Windows 8 / Windows Server 2012 :
   
5. Next, go to the General tab and enter vSphere 8.x in the Template display name field.
6. Switch to the Extensions tab.
7. Select Application Policies and click Edit.
   • Select Server Authentication and click Remove, then OK.
   • If Client Authentication is present, remove it as well.
8. Now select Basic Constraints and click Edit.
9. Activate the Enable this extension check box and click OK.
10. Select Key Usage and click Edit.
11. Set the check mark next to Signature is proof of origin (non repudiation). Keep the other settings at their default.
12. Click OK.
13. Go to the Subject Name tab.
14. Ensure the Supply in the request option is selected.
15. Click OK to save the template.
16. Next, make the template available for issuance by following the steps in Adding a new template to certificate templates.

Creating a template for VMCA as a Subordinate CA

This template is used when configuring VMCA to act as a Subordinate CA to your Microsoft CA.

1. Connect to the CA server via RDP.
2. Open the Certificate Template Console by clicking Start → Run, then enter certtmpl.msc and confirm by clicking OK.
3. Right-click the Subordinate Certificate Authority template and select Duplicate Template.
4. In the Duplicate Template window, select Windows 8 / Windows Server 2012 :
   
5. Go to the General tab and enter vSphere 8.x VMCA in the Template display name field.
6. Ensure Publish certificate in Active Directory is selected.
7. Go to the Extensions tab.
8. Select Basic Constraints and click Edit.
9. Activate the Enable this extension check box and click OK.
10. Select Key Usage and click Edit.
11. Ensure the following options are enabled: Digital Signature, Certificate signing and CRL signing.
12. Ensure that Make this extension critical is enabled, then click OK
13. Click OK to save the template.
14. Next, make the template available for issuance by following the steps in Adding a new template to certificate templates.

Adding a new template to certificate templates

1. Connect to the CA server via RDP.
2. Open the Certification Authority console by clicking Start → Run, then enter certsrv.msc and conmfirm by clicking OK.
3. In the left pane, expand the CA node (click the + icon if collapsed).
4. Right-click Certificate Templates and select New → Certificate Template to Issue.
5. Locate and select both vSphere 8.x and vSphere 8.x VMCA under the Name column.
6. Click OK

Additional Information

• Obtaining vSphere certificates from a Microsoft Certificate Authority