Provides steps to generate CSR and manually replace Custom Certificates in vSphere.
Note: Applies to VCSA 6.x / 7.x only.
Symptoms:
VMware vCenter Server Appliance 6.5.x
VMware vCenter Server Appliance 6.7.x
VMware vCenter Server Appliance 7.0.x
mkdir /certs
cp /usr/lib/vmware-vmca/share/config/certool.cfg /certs/Machine_ssl_cert.cfg
/usr/lib/vmware-vmca/bin/certool --genkey --privkey=machine_ssl_cert.priv --pubkey=machine_ssl_cert.pubkey
/usr/lib/vmware-vmca/bin/certool --initcsr --privkey=machine_ssl_cert.priv --pubkey=machine_ssl_cert.pubkey --csrfile=machine.csr --config=Machine_ssl_cert.cfg
machine.crt
, refer to Obtaining vSphere certificates from a Microsoft Certificate Authority./usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT > oldmachine.crt
/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store MACHINE_SSL_CERT --alias __MACHINE_CERT > oldmachinekey.key
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CERT
/usr/lib/vmware-vmafd/bin/vecs-cli entry create --store MACHINE_SSL_CERT --alias __MACHINE_CERT --cert machine.crt --key machine_ssl_cert.priv
-t
.
/usr/lib/vmware-lookupsvc/tools/ls_update_certs.py --url https://<vCenterServer_FQDN>/lookupservice/sdk --certfile <cert-file-path> --user '[email protected]' --password '<password>' --fingerprint <SHA1_hash_of_the_old_certificate_to_replace>
ls_update_certs.py
will fail with an attribute error. Please refer to KB for steps to work around this.For more information refer to Replacing a vSphere 6.x /7.x Machine SSL certificate with a Custom Certificate Authority Signed Certificate.
Impact/Risks: