Machine SSL certificate renewal using Custom Certificate Authority (CA) in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

This article details the process for replacing a vCenter Machine SSL certificate with a Custom Certificate Authority (CA) signed certificate.

Important considerations:

• Embedded Platform Services Controller (PSC): Requires only one Machine SSL certificate.

• External Platform Services Controller: Requires a unique Machine SSL certificate for every machine. Perform this replacement procedure on each individual machine.

• Wildcard Certificates: Not supported on vCenter Server. For more details, review the vSphere Certificate Requirements for Different Solution Paths documentation.

Environment

• vCenter Server 7.0.x

• vCenter Server 8.0.x

Cause

• Import failures or "hung" import processes typically occur due to strict certificate chain formatting requirements.

• vCenter Server requires the machine_name_ssl.cer file to be combined top-down in an exact sequence: Machine/Leaf Certificate, Intermediate Certificate(s), and Root Certificate.

Resolution

Note: Use the vCert - Scripted vCenter Expired Certificate Replacement tool for an automated workflow to manage all certificates and workflows, including replacing Machine SSL Certificates.

For custom machine certificates using a Microsoft Certificate Authority (CA) not yet configured with a template, review Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 6.x/7.x (315271).

To allow WinSCP connections to a vCenter Server Appliance, review Connecting to vCenter Server Virtual Appliance using WinSCP (326317).

Manual Replacement Procedure:

1. Launch the VMware Certificate Manager for vCenter Server 6.x/7.x/8.x Appliance:
   
   /usr/lib/vmware-vmca/bin/certificate-manager

2. Select Option 1 (Replace Machine SSL certificate with custom certificate).

3. Provide the [email protected] password when prompted.

4. Select Option 1 (Generate Certificate Signing Request(s) and Key(s) for Machine SSL certificate).

5. Enter the directory to save the certificate signing request (CSR) and the private key. 
   
   Note: For vCenter Server 8.0 U2 and later, do not use /tmp as the directory to store or export the CSR, private key, or certificate files to avoid the error INVALID_KEY, the private key does not match the certificate.

6. Verify the Primary Network Identifier (PNID) matches the Hostname by running the following command:

   /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost && hostname -f

   Note: Use the following values for CSR generation:

   Country: Two uppercase letters (e.g., US), the country where the company is located.
Name: FQDN of the vCenter Server (Used as the Certificate Subject Alternate Name)
Organization: Company Name
OrgUnit: Department within the organization (e.g., IT)
State: State or province
Locality: City
IPAddress: IP Address of vCenter Server
Email: Email Address
Hostname: FQDN of vCenter Server (accepts multiple entries separated by comma. e.g., VCSA1.vsphere.local, vcsa1, VCSA_IPaddress)
VMCA Name: FQDN of vCenter Server

   The files created will have the names vmca_issued_csr.csr and vmca_issued_key.key.

7. Provide the generated vmca_issued_csr.csr to the Certificate Authority to generate a Machine SSL Certificate. Name the file machine_name_ssl.cer.
   
   Review Obtaining vSphere certificates from a Microsoft Certificate Authority (315372) for additional details.

8. Return to the vCenter Server Certificate Manager and select Option 1 (Continue to importing Custom certificate(s) and key(s) for Machine SSL certificate). 

9. Provide the full path to machine_name_ssl.cer, vmca_issued_key.key from Step 5, and the CA certificate Root64.cer.

   Note: If using one or more intermediate certificate authorities, root64.cer must be a chain of all intermediate CA and Root CA certificates. The machine_name_ssl.cer file must be a complete chain formatted top-down, including the machine, intermediate CA(s), and root certificates in the exact order shown below:
   
   -----BEGIN CERTIFICATE-----
<alphanumeric certificate characters> <----- Machine/Leaf Certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<alphanumeric certificate characters> <----- Issuer/Intermediate Certificate (if applicable)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<alphanumeric certificate characters> <----- Root Certificate
-----END CERTIFICATE-----

10. Answer Y to the confirmation request to proceed.

Additional Information

• How to use vSphere Certificate Manager to Replace SSL Certificates

• Regenerate vSphere 6.x, 7.x, and 8.0 certificates using self-signed VMCA

• Replacing the vSphere 6.x Machine SSL certificate with a VMware Certificate Authority issued certificate

• "ERROR certificate-manager 'lstool get' failed: 1" during Certificate Replacement on vCenter Server 6.x

• Connecting to vCenter Server Virtual Appliance using WinSCP fails with the error: Received too large (1433299822 B) SFTP packet. Max supported packet size is 1024000 B

• Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 6.x/7.x

• Obtaining vSphere certificates from a Microsoft Certificate Authority