VCF License Server certificate replacement with an external CA-signed certificate

Products

• VCF Operations

Issue/Introduction

In a VCF Operations environment, you may need to replace the default VMCA-signed certificate for the VCF License Server with an external self-signed certificate (with a certificate authority (CA) such as Venafi).

Environment

• VCF Operations 9.1.0
• VCF License Server 9.1.0

Resolution

Follow these steps to generate a Certificate Signing Request (CSR) and apply the new certificate.

Prerequisites

• Access to VCF Operations UI and SSH with administrative/root credentials.
• A text editor to save tokens and IDs.

Step 1: Acquire an Operations Token

1. Navigate to https://<VCF Operations>/suite-api.
2. Click Authorize, enter the admin user credentials, and click Authorize > Close.
3. Click on any GET operation (e.g., Actions > /api/actiondefinitions).
4. Click Try It Out, then click Execute.
5. In the black box under the curl command, locate the OpsToken value. Copy this token and save it to a text file.

Step 2: Identify the License Server ID

1. Log into the VCF Operations appliance via SSH using the root account.
2. Run the following command, replacing <VCF Operations> with your appliance IP/FQDN and <token> with the token from Step 1:
   
   curl -kX 'GET' \
  'https://<VCF Operations>/suite-api/internal/extension/vcf-license-cloud-integration/license-servers' \
  -H 'accept: application/json' \
  -H 'Authorization: OpsToken <token>' \
  -H 'x-ops-api-use-unsupported: true'
3. Locate the "id" field in the response and copy the ID string next to it between the quotes and save it; this is your license server ID.

Step 3: Generate the CSR

1. Run the following command from the SSH session, replacing the placeholders with your environment values:
   
   curl -kX 'POST' \
  'https://<VCF Operations>/suite-api/internal/extension/vcf-license-cloud-integration/license-servers/<license_server_ID>/csr' \
  -H 'accept: application/json' \
  -H 'Authorization: OpsToken <token>' \
  -H 'x-ops-api-use-unsupported: true'
2. Copy the returned data starting with -----BEGIN CERTIFICATE REQUEST----- and ending with -----END CERTIFICATE REQUEST-----.
3. Save this content to a file, ensuring there is no extra whitespace.

Note: The CSR does not contain an entry for Common Name. If your CA requires a Common Name, the certificate generation process will fail. This is a known limitation that will be resolved in a future release of VCF Operations.

Step 4: Create and Upload the Certificate

1. Submit the CSR to your CA to generate a certificate in PEM format.
2. Upload the resulting certificate file to the /root directory of the VCF Operations appliance.

Step 5: Install the New Certificate

1. From the VCF Operations appliance SSH, run the following command. Replace placeholders with your environment info and <mycert.pem> with your actual filename:
   
   curl -kX 'PUT' \
  'https://<VCF Operations>/suite-api/internal/extension/vcf-license-cloud-integration/license-servers/<license_server_ID>/certificate' \
  -H 'accept: application/json' \
  -H 'Authorization: OpsToken <token>' \
  -H 'x-ops-api-use-unsupported: true' \
  --form 'certificate=@/root/<mycert.pem>' \
  -H 'content-type: multipart/form-data'

Verification

To verify the update, navigate to https://<license_server> (using the License Server FQDN or IP) in your browser and inspect the certificate details.

Additional Information

Assigning a custom certificate to the VCF License Server with VCF Operations will be supported in a future version of VCF Operations. 

Subscribe to a Broadcom knowledge article by article or product