STS_INTERNAL_SSL_CERT replacement using vCert - VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

The Security Token Service (STS) on port 3128 presents an expired certificate. This legacy certificate, stored in the STS_INTERNAL_SSL_CERT VECS store, typically remains in the environment following an upgrade from vCenter 5.5 or 6.x to vCenter 7.x or 8.x.

 

This article explains the process to replace STS_INTERNAL_SSL_CERT using vCert.

• Security scanners may indicate that the service on port 3128 is utilizing an expired certificate.
  
  
• Compliance alerts triggered for expired identity management certificates.
  
  
• To view the certificate, execute below command on vCenter Server Appliance.
  openssl s_client -connect localhost:3128 -showcerts
  
  
• When running vCert Script to check the vCenter certificate the report will show vmware-stsd service uses a legacy certificate.
  
  Checking STS Server Configuration
-----------------------------------------------------------------
Checking VECS store configuration                          LEGACY

Environment

• VMware vCenter Server 7.x / 8.x
• VMware Cloud Foundation 4.x / 5.x

Cause

In vCenter 6.x and earlier, the vmware-stsd service utilized a legacy certificate stored in STS_INTERNAL_SSL_CERT. During upgrades, these configurations are migrated to ensure continuity. However, newer vCenter versions do not automatically update this store when the Machine SSL certificate is renewed, leading to silent expiration.

Resolution

Follow vCert - Scripted vCenter expired certificate replacement for the installation and script running guidelines.

Note: Executing below steps will lead to restart of vmware-stsd service.

To renew the expired certificate for the below steps,

1. Create a file-based backup or a snapshot of the vCenter Server (offline snapshots are required if using Enhanced Linked Mode of all vCenter nodes).
   
   
2. Log in to the vCenter Server Appliance via SSH as root.
   
   
3. Run the vCert script
./vCert.py
 
4. Select option 5 (Check Configurations)
   
   
   
   
   
5. Select Option 2 to check the STS certificate & its configuration
   
   
   
   
6. Enter the [e-mail] account credentials
   
   
   
   
7. If it shows as LEGACY as highlighted below, select Yes(y) to update STS server configuration to use MACHINE_SSL_CERT store
   
   
   
   
8. Once the configuration update is completed, hit Yes(y) to restart vmware-stsd service
   
   
   
   
   
9. Executing openssl command on port 3128 should now show updated certificate
   openssl s_client -connect localhost:3128 -showcerts

Additional Information

Here is how vCert handles STS_INTERNAL_SSL_CERT.

• When MACHINE SSL certificate is refreshed, STS_INTERNAL_SSL_CERT is automatically updated to the new MACHINE SSL, as it's expected.
  
  
• You can remove STS_INTERNAL_SSL_CERT by below command:
  
  ./vCert.py --run ./config/check_config/sts_config/op_check_sts_config.yaml

For assistance, see Contact Broadcom Support.