Prestage root and intermediate certificates in Aria for Logs

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VMware Cloud Foundation

Issue/Introduction

• How to import the certificate into Aria Operations for logs trust store
• Preparing to migrate to a new Certificate Authority (CA)
• Prestaging root and intermediate CA certificates is required prior to CA cutover to prevent SSL/TLS handshake failures, broken API integrations, or endpoint rejections.

Environment

Aria for Logs: 8.x, 8.18

VCF: 5.2

Resolution

1. Take a snapshot of the Aria for Logs appliances via vCenter.

2. For all Aria for Logs nodes, import the new root/intermediate CA certificates to the cacerts trust stores using the following command:

   • /usr/java/jre-vmware/bin/keytool -import -alias <alias> -file /tmp/<certfile> -keystore /usr/java/jre-vmware/lib/security/cacerts -storepass changeit -noprompt

   • Note: You will want to run this command once for the Root CA, and once for each Intermediate CA.

3. Confirm the new CA certificates were successfully imported:

   • /usr/java/jre-vmware/bin/keytool -list -keystore /usr/java/jre-vmware/lib/security/cacerts -storepass changeit -alias <alias>

4. Apply Shut Down Guest OS on all Aria for Logs VMs via ACTIONS > Power within vCenter.