Renew expiring/expired LDAPS certificate for vCenter SSO Identity Provider

Products

• VMware vCenter Server 7.0
• VMware vCenter Server 8.0

Issue/Introduction

vCenter triggered an alarm regarding LDAPS certificate expiry or LDAPS user authentication stops working due to LDAPS certificate expired:  "Identity Source LDAP Certificate is about to expire"

Environment

vCenter Server 7.0

vCenter Server 8.0

Cause

LDAPS Identity Provider SSO authentication relies on LDAPS service machine certificate to be valid for authentication to succeed. If the LDAPS certificate expires, authentication via this Identity Provider will fail.

Resolution

Follow the below steps to fix the issue:

• Verify the validaity of the certificate using either of the below commands:
  • /opt/vmware/bin/sso-config.sh -get_identity_sources
  • openssl s_client -connect domain_controller.example.com:636 -showcerts
• Renew the certificates on the Domain controller.
• Remove existing LDAPS IdP configuration and re-create it using new LDAPS machine certificate chain:
  • Take snapshot of VCSA VM prior to making any changes.
    • If the vCenter is part of a Linked Mode replication setup, please backup/snapshot all replicating nodes as well. Please refer: VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice
    • Perform the following steps on only one of the linked vCenter servers, since the IdP configuration will be replicated to the other linked vCenter servers.
  • Take note of the current LDAPS configuration as you will need these details to re-create the LDAPS configuration.
  • Remove the existing LDAPS configuration and re-create it using the new LDAPS machine certificate (KB 316596).
    • NOTE: Make sure the certificate file being used is a valid ".cer" or ".crt". File format ".p7b" is not valid for this use.

Additional Information

Use proper certificate file for VC LDAPS IdP configuration:

• If you have only the ".p7b" file, import the cert to the "Personal" cert folder of the client machine being used (if Windows use Certificate Manager for local machine).
• Export the cert as Base64. This should create a cert in ".cer" format. You should be able to view this cert with notepad in clear text, and when you double click it, it should open successfully in Windows Certificate Manager.
• Once the cert is exported, delete the cert from "Personal" folder that was imported from the ".p7b" file.

Fails to save LDAPS configuration if trying to edit the existing configuration:

• The configuration needs to be removed and re-created to update the LDAPS certificate.