Symptoms:
When generating Certificate Signing Requests (CSRs) and the private key pair for the Machine SSL certificate or the Solution user certificates, after modifying the
/usr/lib/vmware-vmca/share/config/certool.cfg file or
C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg file, you experience these symptoms:
- The certificates generated from the CSR are identical to the SSL certificates previously used on the vCenter Server or Platform Services Controller
- The certificates generated do not adhere to the information provided in the certool.cfg configuration for the vCenter Server or Platform Services Controller
- Per the /var/log/vmware/vmcad/certificate-manager.log file or C:\ProgramData\VMware\vCenterServer\logs\vmca\certificate-manager.log file, you see entries similar to:
YYYY-MM-DDT<time>Z INFO certificate-manager Selected operation: Replace VMCA Root certificate with Custom CA Certificate and replace all certificates (signed by Custom CA root</time>
YYYY-MM-DDT<time>Z INFO certificate-manager Please provide a directory location to write the CSR(s) and PrivateKey(s) to:
YYYY-MM-DDT<time>Z INFO certificate-manager Generating key
YYYY-MM-DDT<time>Z INFO certificate-manager Running command: ['C:\\Program Files\\VMware\\vCenter Server\\vmcad\\certool.exe', '--genkey', '--privkey', 'C:\\certs\\root_signing_cert.key', '--pubkey', 'c:\\users\\admini~1\\appdata\\local\\temp\\1\\pubkey.pub']
YYYY-MM-DDT<time>Z INFO certificate-manager Running command: ['C:\\Program Files\\VMware\\vCenter Server\\vmcad\\certool.exe', '--gencsrfromcert', '--privkey', 'C:\\certs\\root_signing_cert.key', '--cert', 'C:\\ProgramData\\VMware\\vCenterServer\\data\\vmca\\root.cer', '--csrfile', 'C:\\certs\\root_signing_cert.csr']
YYYY-MM-DDT<time>Z INFO certificate-manager CSR generated at: C:\certs\root_signing_cert.csr</time></time></time></time></time>
Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.