This issue can be resolved depending on the environment, on whether the VMCA is an intermediate certificate, and on whether the web browser uses the operating system certificate store (Internet Explorer, Chrome) or manages its own certificate store (Firefox).
Note: It is recommended to connect to the vCenter Server FQDN on environments with External Platform Services Controllers, as the option to "Download trusted root CA certificates" is only available on vCenter Server Appliance URL (whether it is Embedded PSC or Management Node).
Certificate Download in Small Deployments
This procedure is for environments that have the following characteristics:
- A web browser that uses the operating certificate store on Windows (such as Internet Explorer or Google Chrome)
- A small deployment with one or two client machines that connect to a vCenter Server installation
- Use of default certificates or custom certificates
Download the VMware Certificate Authority (VMCA) root and leaf certificates and then add them to the operating system root store of the machine attempting to connect to the vCenter Server system. Refer to the Additional Information section in this KB for screenshots.
- From a client system web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension.
For example:
https://vcenter.example.com/
Note:
- Direct URL to download the Certificate is https://vCenter_FQDN/certs/download.zip
- Example -
https://vcenter.example.com/certs/download.zip
.
- From Linux machines, wget command can be used to download the Certificates
- Example - "
wget https://vcenter.example.com/certs/download.zip
"
- Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
- Change the extension of the file to .zip.
The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS).
- Extract the contents of the ZIP file.
The result is a .certs folder that contains two types of files.
- Files with a number as the extension (.0, .1, and so on) are root certificates.
- Files with an extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate.
- Install the certificate files as trusted certificates by following the process that is appropriate for the operating system. For most Microsoft Windows systems, follow the instructions at Manage Trusted Root Certificates.
Firefox has its own trusted roots store and does not use the operating system store. If working with Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click Certificates to import the certificate into Firefox.
Active Directory Group Policy Update in Deployments with VMCA as an Intermediate Certificate Authority
This procedure is for environments that have the following characteristics:
- A web browser that uses the operating certificate store on Windows (such as Internet Explorer and Google Chrome)
- The vCenter Server system is accessed from several different machines
- VMCA is set up to be an intermediate CA
Import the root certificate into the group policy of the Active Directory environment to make the certificates trusted in the Active Directory domain. After the certificates are trusted, the browser error no longer appears on any machine that is part of the Active Directory domain.
- From a client system web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension.
For example:
https://vcenter.example.com/
Note:
- Direct URL to download the Certificate is https://vCenter_FQDN/certs/download.zip
- Example -
https://vcenter.example.com/certs/download.zip
- From Linux machines, wget command can be used to download the Certificates
- Example - "
wget https://vcenter.example.com/certs/download.zip
"
- Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
- Change the extension of the file to .zip.
The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS).
- Extract the ZIP file.
The result is a .certs folder that contains two types of files.
- Files with a number extension (.0, .1, and so on) are root certificates. Change the extension to .crt.
- Files with a extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate. Change the extension to .crl.
- Open the Active Directory Group Policy Management Editor.
- Open Public Key Policies and select Intermediate Certification Authorities.
- Add the certificate file or files that was downloaded.
- From the Windows command prompt, run gpupdate /force to force an update.
Firefox has its own trusted roots store and does not use the operating system store. If working with Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click Certificates to import the certificate into Firefox.
Active Directory Group Policy Update in Deployments with Custom Certificates or VMCA-Signed Certificates
This procedure is for environments that have the following characteristics:
- A web browser that uses the operating certificate store on Windows (such as Internet Explorer and Google Chrome)
- The vCenter Server system is accessed from several different machines
- A root certificate from a CA that is not trusted in the environment. That CA can be VMCA or a different CA that is not trusted.
Import the root certificate into the group policy of the Active Directory environment to make the certificates trusted in the Active Directory domain. After the certificates are trusted, the browser error no longer appears on any machine that is part of the Active Directory domain.
- From a client system web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension.
For example:
https://vcenter.example.com/
Note:
- Direct URL to download the Certificate is https://vCenter_FQDN/certs/download.zip
- Example -
https://vcenter.example.com/certs/download.zip
- From Linux machines, wget command can be used to download the Certificates
- Example - "
wget https://vcenter.example.com/certs/download.zip
"
- Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
- Change the extension of the file to .zip.
The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS).
- Extract the contents of the ZIP file.
The result is a .certs folder that contains two types of files.
- Files with a number extension (.0, .1, and so on) are root certificates. Change the extension to .crt.
- Files with a extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate. Change the extension to .crl.
- Open the Active Directory Group Policy Management Editor.
- Open Public Key Policies and select Trusted Root Certificate Authorities.
- Add the certificate file or files that was downloaded.
- From the Windows command prompt, run gpupdate /force to force an update.
Firefox has its own trusted roots store and does not use the operating system store. If working with Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click Certificates to import the certificate into Firefox.