Symptoms:
After replacing solution user certificates using the certificate manager, you experience these symptoms:
/var/log/vmware/vapi/endpoint.log
file, you see entries similar to:This issue is caused by a change in the certificate-manager in vCenter Server Update 1b. New options are present for processing the certool.cfg file correctly, as well as processing config files for each individual solution user. If these config files do not have unique information for each solution user, the generated certificates have the same Subject.
For example, in the C:\ProgramData\VMware\vCenterServer\logs\vmca\certificate-manager.log file, you see entries similar to:
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Selected operation: Replace Solution user certs with VMCA Certificate
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Please configure machine.cfg with proper values before proceeding to next step.
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Press Enter key to skip optional parameters or use Default value.
[YYYY-MM-DDTHH:MM:SS]INFO certificate-manager machine.cfg file contents.
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Country = US
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Name = vSphere
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Organization = VMware
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager OrgUnit = Support
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager State = Colorado
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Locality = Denver
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager #IPAddress =
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Email = [email protected]
[YYYY-MM-DDTHH:MM:SS] INFO certificate-manager Hostname = vcsa.domain.com
The same information will be seen for these options in the other config files (vsphere-webclient.cfg, vpxd.cfg, vpxd-extension.cfg
) which causes the certificates not to be unique.
This issue is resolved in vCenter Server 6.0 Update 3, To download go to - Download Broadcom products and software
Workaround:
To workaround this issue, re-generate new Solution User Certificates, ensuring that each certificate is given a unique subject.
This can typically be achieved by making the Name: value unique for each Solution user
.
Using the Certificate Manager > Select Option 6 to re-generate new VMCA issue SOlution User Certificate.