使用 6.0 Update 3 中支持的选项设置备用 OCSP 响应者证书
sso-config.sh -set_authn_policy -t vsphere.local -ocspUrl http://<CA-FQDN>/ocsp -ocspCert <path_to_ocsp_signing_ca_cert>.cer
在 Windows 中,
cd <C:\Program Files\Vmware\vCenter Server\Vmware Identity Services\>
sso-config.bat
在 Linux 中,
cd /opt/vmware/bin
sso-config.sh
例如:
sso-config.sh -set_authn_policy -t vsphere.local -ocspUrl http://<OSCPhostname>/ocsp -ocspCert ca_pslab1_com.cer
检查身份验证策略以查看 OCSP URL 和证书的设置是否正确。
sso-config.sh -get_authn_policy -t vsphere.local
IsPasswordAuthEnabled: true
IsWindowsAuthEnabled: true
IsTLSClientCertAuthnEnabled: true
IsSecurIDAuthnEnabled: false
revocationCheckEnabled: true
useOCSP: true
sendOCSPNonce: false
useCRLAsFailOver: true
OCSPResponderSigningCert: CN=CA, DC=<DC>, DC=com
OCSPUrl: http://<OSCPhostname>/ocsp
useCertCRL: true
CRL CacheSize: 512
CRLUrl: UndefinedConfig
trustedCA: CN=<hostname>-CA, DC=<DC>, DC=com
trustedCA: CN=<hostname2>-CA, DC=<DC>, DC=<DC2>, DC=com