How to replace VMware Aria Suite Lifecycle certificate via command line post-expiration

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VMware vRealize Suite Lifecycle Manager 8.x
• VCF Operations

Issue/Introduction

• VMware Aria Suite (vRSLCM) UI is inaccessible.
• The certificate file will be expired in the directory /opt/vmware/vlcm/cert.

Environment

VMware Aria Suite Lifecycle 8.x
VCF Operations 9.x

Cause

The NGINX web server certificate (server.crt) on the appliance has expired. Because NGINX acts as the entry point for the UI, an expired certificate prevents the service from establishing secure connections, rendering the management interface unavailable.

Resolution

Prerequisites

• You require SSH access to the vRSLCM appliance. An SCP application can be installed if desired.
• Take a snapshot of the VMware Aria Suite Lifecycle Manager node.

Note: For VCF 9.x, a Fleet Management appliance is the same as VMware Aria Suite Lifecycle Manager (LCM).

Generate a self-signed certificate

1. Log in to the node as root via SSH.
2. Generate in staging: Navigate to the temporary directory and generate the new certificate:

   cd /tmp
   openssl req -newkey rsa:2048 -keyout server.key -x509 -days 3650 -out server.crt -nodes

3. Secure existing files: Move the old certificates out of the production path to a backup location:

   mv /opt/vmware/vlcm/cert/server.crt /tmp/server.crt.old
   mv /opt/vmware/vlcm/cert/server.key /tmp/server.key.old

4. Deploy new files: Move the verified certificates into the production directory:

   cp /tmp/server.crt /opt/vmware/vlcm/cert/server.crt
   cp /tmp/server.key /opt/vmware/vlcm/cert/server.key

5. Restart & Verify:

   systemctl restart nginx
   systemctl status nginx

Additional Information

If you are required to replace the certificate with a custom certificate, follow this process:
Replace your VMware Aria Suite Lifecycle custom certificate