Process to manually publish the full chain to the VMware Endpoint Certificate Store:
To work around this issue, manually publish the full chain to the VMware Endpoint Certificate Store:
For Windows vCenter Server 6.x:
- Click Start > Run, type cmd and press Enter.
- Add the certificate to the VMware Endpoint Certificate Store with this command:
"C:\Program Files\VMware\vCenter Server\vmafdd\dir-cli.exe" trustedcert publish --chain --cert path_to_chain.cer
Note: The path_to_chain.cer is the complete path to the full chain of Intermediate CA(s) and Root CA.
- Enter the password for [email protected] when prompted.
- Run the certificate replacement option again.
- When the Certificate Manager asks for the signing certificate provide just the Root CA certificate and not the full chain of CA certificates.
For example:
Please provide the signing certificate of the Machine SSL certificate
File : "C:\certs\machineSSL\root_ca.cer"
For vCenter Server Appliance 6.x:
- If the certificates are not currently on the vCenter Server Appliance copy them to a directory on the file system such as /root using a utility such as WinSCP or Filezilla.
Note: VMware does not endorse or recommend any particular third-party utility, nor is the list above meant to be exhaustive.
- Connect to the vCenter Server Appliance through the console and press ALT+F1.
- Log in using the root user and password.
- Type shell.set --enabled true and press Enter.
- Type shell and press Enter.
- Add the certificate to the VMware Endpoint Certificate Store with this command:
/usr/lib/vmware-vmafd/bin/dir-cli trustedcert publish --chain --cert path_to_chain.cer
- Enter the password for [email protected] when prompted.
- Run the certificate replacement option again.
- When the Certificate Manager asks for the signing certificate provide just the Root CA certificate and not the full chain of CA certificates.
For example:
Please provide the signing certificate of the Machine SSL certificate
File : "/root/root_ca.cer"