OpenSSL CA configuration missing from management interface after upgrading to VMware Cloud Foundation 9.1

Products

• VCF Operations

Issue/Introduction

• Upgrading from VMware Cloud Foundation (VCF) 9.0.x to 9.1 causes the instance-level OpenSSL CA configuration to disappear from the management interface.
  
  
• Certificates previously signed by this CA appear as "External CA" or "VMCA" depending on the component.
  
  
• This transition leads to the loss of automated certificate management and auto-renewal support within the Fleet Lifecycle of VCF Operations.

Environment

VMware Cloud Foundation 9.1

Cause

An architectural design change in VCF 9.1 migrates certificate orchestration from SDDC Manager (SDDC-M) to a decentralized Fleet Lifecycle service. OpenSSL CA configurations established in VCF 9.0.2 through SDDC-M do not migrate to the new design. The system subsequently treats legacy certificates as external entities.

Resolution

Reconfigure the OpenSSL CA at the fleet level to restore managed status and re-enable auto-renewal. This procedure is a one-time operation.

1. Navigate to Certificate Management in VCF Operations.
   
   
2. Select Configure CA for fleet to establish a new OpenSSL CA entry.
   
   
3. Generate new Certificate Signing Requests (CSRs) for the affected components.
   
   
4. Include all node Fully Qualified Domain Names (FQDNs) and IP addresses in the Subject Alternative Name (SAN) field.
   
   
5. Sign the CSRs with the OpenSSL CA.
   
   
6. Import the full certificate chain (Root, Intermediate, Leaf) into VCF Operations.
   
   
7. Replace existing certificates with the new fleet-managed versions.

The Certificate Type displays as OPENSSL CA once the steps are complete, and lifecycle automation restores.

Additional Information

Refer to the below document for detailed steps:

Configure a Certificate Authority for VMware Cloud Foundation