For Cloud Director 10.5.1 and later follow the updated steps which include stopping and restarting the Cloud Director services as part of the process, Replace or Renew the VMware Cloud Director Appliance Management Certificates.
To resolve the issue in earlier versions of Cloud Director simply stop the Cloud Director services on the Cells before changing the Appliance Management certificate and start the Cloud Director services on the Cells after the new certificate has been applied.
Example steps would be as follows:
- Before changing the certificate schedule a downtime and stop the Cloud Director service on all Cells in the cluster, the guest OS of the Cells does not need to be shutdown:
/opt/vmware/vcloud-director/bin/cell-management-tool -u <VCD_ADMIN_USERNAME> cell --shutdown
systemctl stop vmware-vcd
- Proceed to apply the new certificate to the Cells as per the Cloud Director documentation, Replace the Appliance Management Key-Certificate Pair.
- After replacing the certificate and key, and restarting the Appliance VAMI and PostgreSQL services wait 2 minutes to ensure the Appliance Sync service of all the Cloud Director Cells is able to update the truststores with the Cell's new cert. The Appliance Sync logs can be followed to confirm that this is occurring, it should update approximately every ~60 seconds:
tail -f /opt/vmware/var/log/vcd/appliance-sync.log | grep "Executing vcd appliance sync scripts\|Updating VCD trust store\|Successfully completed run of appliance sync script"
- Confirm the new certificate is present in all the Cells' truststore:
less -i /opt/vmware/vcloud-director/etc/truststore.pem
- Restart the Cloud Director service again on all the Cells:
systemctl start vmware-vcd
- Confirm that the Cloud Director Provider and Tenant UIs become available once the services have finished startup.