After renewing a ESXi Host Certificate, directly connecting to the host using browser gives non secure connection status

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• The certificate is renewed, however, it's only trusted to the VMCA. As a result, the certificate is not trusted when accessing the host directly through a browser.
• Full certificate chain is not pushed to the ESXi host after renewing certificate (Host -> Certificates -> Renew Certificate).

Cause

This issue occurs because the first certificate is saved and all intermediate certificate (if any) are truncated.

Resolution

This issue is resolved in ESXi 6.7 Update 2, available at VMware Downloads.

Workaround:
For ESXi 6.7:

1. SSH to the ESXi host.
2. Make a backup of the rhttpproxy config file:

cp /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/config.xml.bak

3. Edit the file:vi /etc/vmware/rhttpproxy/config.xml
4. Edit (what should be) line 77/78 (to remove the comment out):

<-- <keyStoreFile>/etc/vmware/ssl/castore.pem</keyStoreFile> --> 

to

<keyStoreFile>/etc/vmware/ssl/castore.pem</keyStoreFile>

5. Save the file.
6. Restart the rhttpproxy service (or reboot the ESXi host):

/etc/init.d/rhttpproxy restart

7. Confirm the ESXi host full certificate chain is present from the Host UI client.

 
For ESXi 6.5:

1. SSH to the ESXi host.
2. Make a backup of the rhttpproxy config file:

cp /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/config.xml.bak

3.  Edit the file:

vi /etc/vmware/rhttpproxy/config.xml

4. Find the following lines:

<ssl>
     <!-- The server private key file -->
     <privateKey>/etc/vmware/ssl/rui.key</privateKey>

     <!-- The server side certificate file -->
     <certificate>/etc/vmware/ssl/rui.crt</certificate>
  </ssl>

5. Add the highlighted lines between the first <ssl> </ssl> section:

<ssl>
     <!-- The server private key file -->
     <privateKey>/etc/vmware/ssl/rui.key</privateKey>

     <!-- The server side certificate file -->
     <certificate>/etc/vmware/ssl/rui.crt</certificate>

     <!-- Client-side CAFile verify location -->
     <keyStoreFile>/etc/vmware/ssl/castore.pem</keyStoreFile>
  </ssl>

6. Save the file.
7. Restart the rhttpproxy service (or reboot the ESXi host):

/etc/init.d/rhttpproxy restart

8. Confirm the ESXi host full certificate chain is present from the Host UI client.