VCF Mgmt (Configure Certificate Authority) area - error

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

When attempting to implement a custom certificate template using a Microsoft Certificate Authority (CA) in VMware Cloud Foundation (VCF) SDDC Manager, the operation fails.
The /var/log/vmware/vcf/operationsmanager/operationsmanager.log records the following errors connecting to the Microsoft Certificate Authority:

• Status code: 401
• Unauthorized: Access is denied due to invalid credentials

Additionally, the certificate template is not visible in the certsrv web interface, preventing IIS or other APIs from using the template to request a certificate.

Environment

VMware Cloud Foundation 9.0.2

Cause

The certificate template on the Microsoft Certificate Authority (CA) is missing the "Authenticated Users" group permission.

Resolution

• Log in to the Microsoft Certificate Authority server.
• • Open the Certificate Templates Console (certtmpl.msc).
  • Right-click the custom certificate template targeted for VMware Cloud Foundation and select Properties.
  • Navigate to the Security tab.
  • Verify the "Authenticated Users" group is present. If it is missing, add the "Authenticated Users" group.
  • Grant the "Authenticated Users" group the appropriate permissions (Read and Enroll) to request certificates.
  • Click Apply and OK.
  • Retry the custom certificate template operation in VCF SDDC Manager.

Additional Information

For further guidance on certificate management in VCF, refer to the Broadcom TechDocs for VMware Cloud Foundation.

Configure the Microsoft Certificate Authority for Basic Authentication