Configure and Install a Web Certificate For VCF Operations
search cancel

Configure and Install a Web Certificate For VCF Operations

book

Article ID: 320343

calendar_today

Updated On:

Products

VCF Operations/Automation (formerly VMware Aria Suite) VCF Operations

Issue/Introduction

This article provides instructions for using OpenSSL to configure an authentication certificate for use with VCF Operations (formerly known as Aria Operations). This certificate is commonly referred to as Web Certificate and is used exclusively for securing user interface connections to external clients.

Custom certificate updates for specific internal components like Java or Gemfire on internal ports (e.g., 6061, 10000, 20000) are not permitted. Failure to include proper certificate extensions will result in an "extendedKeyUsage extension is not present" error during installation

See VCF Operations Certificates documentation for further details.

Note: The certificate cannot be changed on the internal ports: for example port 6061, 10000 and 20000 ranges. This certificate, on the internal ports, is instead of commonly referred to as Internal certificate.

Environment

VCF Operations 9.x
VMware Aria Operations 8.x

Cause

A custom web certificate must be securely generated, signed by a Certificate Authority (CA), and compiled into a PEM format with a strict specific order (server certificate, private key, intermediate certificates, root certificate). It must also include the extendedKeyUsage = serverAuth, clientAuth extension to successfully secure external UI connections to the cluster.

Resolution

Note: Take a snapshot of the VCF Operations cluster (without memory) before performing these steps. KB 342576
 

Step 1: Generate a New Certificate Signing Request (CSR)

  1. Log into the VCF Operations Primary node as root via SSH or Console.

  2. Create and navigate to the certificate directory:

    mkdir /cert && cd /cert

  3. Create a new configuration file called aops.cnf:

    vi /cert/aops.cnf

  4. Populate the file with the following contents, tailored for your cluster size. Crucially, ensure the extendedKeyUsage line is present to avoid installation failures. Replace the <REDACTED_HOSTNAME> and <REDACTED_IP> values with your actual node FQDNs, shortnames, and IPs:

     
    [req]
prompt = no
distinguished_name = dn
req_extensions = ext
default_bits = 2048
default_md = sha256
encrypt_key = no

[dn]
CN = <REDACTED_HOSTNAME>

[ext]
subjectAltName = @alt_names
extendedKeyUsage = serverAuth, clientAuth

[alt_names]
DNS.1 = <REDACTED_HOSTNAME>
DNS.2 = <REDACTED_HOSTNAME>
DNS.3 = <REDACTED_HOSTNAME>
DNS.4 = <REDACTED_HOSTNAME>
DNS.5 = <REDACTED_HOSTNAME>
DNS.6 = <REDACTED_HOSTNAME>
IP.1 = <REDACTED_IP>
IP.2 = <REDACTED_IP>
IP.3 = <REDACTED_IP>

    Note: If using a load balancer, the CN should be the IP/FQDN of the load balancer. The SAN field should include the IPs/FQDNs for each node in the cluster.

  5. Save and close the file (:wq!).

  6. Create the CSR and Private Key:

    openssl req -new -config /cert/aops.cnf -keyout /cert/aops.key -out /cert/aops.csr

  7. Verify the CSR details:

    openssl req -in /cert/aops.csr -noout -text

Step 2: Sign the Certificate

Choose the appropriate signing method for your environment:

Option A: Custom CA-Signed Certificate

  1. Send the aops.csr file to your Certificate Authority. Inform them of the subjectAltName details.

  2. Download the returned signed leaf certificate, root certificate, and any intermediate certificates in Base64 format.

Option B: Internal VMCA Signed Certificate (vCenter UI)

  1. Copy the contents of aops.csr to your workstation.

  2. Navigate to the vCenter UI.

  3. Go to Hamburger menu > Administration > Certificate management > Trusted root tab.

  4. Select the ROOT CA radio button and click Issue new leaf certificate.

  5. Upload the .csr file and download the resulting .pem and CA root certificate files.

Option C: Internal VMCA Signed Certificate (VCF Operations CLI)

  1. On the Primary node SSH console, navigate to the SSL directory:

    cd /storage/vcops/user/conf/ssl/

  2. Sign the CSR using the local CA:

    openssl x509 -req -in /cert/aops.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out /cert/aops.crt -days 3650

  3. Copy the CA root to the cert directory and navigate back:

    cp cacert.pem /cert/

    cd /cert/

Step 3: Construct the Final PEM File

Combine the certificates into a single PEM file in the exact required order (Server Cert, Private Key, Intermediates, Root CA).

  1. Transfer any downloaded CA certificates to the /cert directory using SCP.

  2. Combine the files using the cat command:

    For Custom CA with Intermediates:

    cat /cert/signed_cert.crt /cert/aops.key /cert/intermediate.crt /cert/cacerts.crt > /cert/multi_part.pem

    For VMCA (Option C):

    cat /cert/aops.crt /cert/aops.key /cert/cacerts.pem > /cert/aops.pem

  3. If using the local VMCA CLI method (Option C), validate the constructed PEM:

    $VMWARE_PYTHON_BIN /usr/lib/vmware-casa/bin/vropsCertificateTool.py -i aops.pem

  4. Copy the final .pem file to your local workstation via SCP.

Step 4: Install the Certificate in VCF Operations

  1. In a web browser, navigate to the VCF Operations admin interface: https://<REDACTED_HOSTNAME>/admin

  2. Log in with the local admin credentials.

  3. For VCF Operations 8.10 or later, click Take Offline under Cluster Status. Wait for the status to show as Offline.

  4. Click the yellow SSL Certificate icon at the upper right.

  5. Click Install New Certificate, then Browse for certificate.

  6. Select your constructed .pem file. Verify the certificate text loads successfully.

  7. Click Install.

  8. Once installed, click Bring Online under Cluster Status and wait for the cluster to initialize.

 

Additional Information

  • If issues occur during application, use the Custom Certificate Tool in VCF Operations to troubleshoot.

  • If an invalid certificate impacts functionality, reload the default certificate to restore access.

  • PEM order verification: Ensure each -----END CERTIFICATE----- ends with a line break and the next -----BEGIN CERTIFICATE----- starts on a new line.

  • Configure a Certificate For Use With VCF Operations Cloud Proxy

  • Disclaimer: Creating custom certificates is out of scope for standard support. For architectural assistance, contact your Support Account Manager or Technical Account Manager.

 
Powered by Wolken Software