VCHA Certificate Rotation
Article ID: 443929
Updated On:
Products
Issue/Introduction
vCenter High Availability (VCHA) is an active-passive clustering feature that protects the VCSA against host and hardware failures. It operates as a 3-node cluster with Active, Passive, and Witness nodes to minimize downtime during patching and unexpected outages. To safely rotate vCenter certificates in an HA environment, additional steps are needed to prevent an unwanted failover event.
Resolution
After making sure VCHA cluster is healthy, place passive node in maintenance mode or shut down guest OS. If changes need to be reverted, manual failover on the passive node can be done to restore vCenter environment.
Once passive node is in maintenance mode, use vCert.py tool per this KB to perform rotation on expiring/expired certificates.
Once certificates have been rotated, follow post-steps per this KB to update postgres DB certs.
Take passive node out of maintenance mode.
Additional Information
Feedback
