Replacing ECDSA based machine_ssl_cert with an RSA certificate fails

Products

• VMware vCenter Server

Issue/Introduction

• machine_ssl_cert uses ECDSA  certificate
• Attempting to replace it with an RSA certificate in vSphere UI fails with the error:
  [CERTIFICATE] Replace cert Failed: Exception found
VecsException occurred.
Caught exception Native platform error [code: 90023]
Adding VecsEntryType.CERT_ENTRY_TYPE_PRIVATE_KEY entry into store 'BACKUP_STORE' failed.
[Server: __localhost__, User: __localuser__]
• Attempting to replace it with an RSA certificate with certificate-manager fails with the error:
  Error while replacing Machine SSL Cert
Error in creating a new entry for bkp___MACHINE_CERT
in VECS Store BACKUP_STORE

Environment

vCenter Server 8.0

Cause

As of vCenter 8.0, vSphere does not support generating ECDSA certificates. VECS enforces this by preventing any new entries being created using certificates based on ECDSA.

As part of the replacement process through vSphere UI or certificate-manager, a backup of the current certificate is created in a backup store in VECS. 

If the machine_ssl_cert has an ECDSA based certificate, this backup entry is rejected by VECS, causing the error.

Resolution

Replace machine_ssl_cert manually with a dummy entry that is compliant with VECS.

1. Snapshot the vCenter as backup. If vCenter is in linked mode, refer to VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice. Do not skip this step
2. Confirm the machine solution user certificate does not use ECDSA by reviewing the algorithm used:
   /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store machine --text | grep "Signature Algorithm"
3. Export a copy of the machine solution user certificate and key:
   /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store machine --alias machine --output /root/dummy.crt
/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store machine --alias machine --output /root/dummy.key
4. Delete the current machine_ssl_cert entry:
   /usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store machine_ssl_cert --alias __MACHINE_CERT 
5. Create a new entry in machine_ssl_cert using the dummy certificate:
   /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store machine_ssl_cert --alias __MACHINE_CERT --cert /root/dummy.crt --key /root/dummy.key
6. Use certificate-manager to replace the machine_ssl_cert as per KB Using vSphere Certificate Manager to Replace SSL Certificates

Additional Information

vSphere Certificate Requirements for Different Solution Paths