LDAPS Identity Source Configuration and Dynamic Certificate Management in vCenter

Products

• VMware vCenter Server 8.0

Issue/Introduction

• Users may encounter significant administrative overhead when Active Directory Domain Controllers (DCs) utilize dynamic SSL/TLS certificate lifecycles (e.g., certificates replaced every 45 days). Under current vCenter LDAPS Identity Source design, the identity source must be reconfigured manually each time the underlying leaf certificates change.
• Users often request the ability to upload only the Domain Controller Root Signing/CA certificates to vCenter and utilize the "ANY" Domain Controller option for LDAPS configuration to eliminate the need for providing individual leaf DC certificates.

Environment

VMware vCenter 7.x

VMware vCenter 8.x

VMware vCenter 9.x

Cause

Technical Constraints & Limitations

• No "ANY" Option in LDAPS Standard: The standard LDAPS protocol does not support an "ANY" or automatic discovery mechanism. Because LDAPS servers do not broadcast their presence, exact endpoints must be defined to establish a secure connection.
  • "ANY Domain Controller" option will be useful in case of LDAPS only when certificates for all the Domain Controllers are provided while configuring LDAPS.
• No Auto-Fetch in vCenter: vCenter currently does not have the functionality to automatically fetch or pull updated certificates directly from Domain Controllers after they are changed on the AD side.
• Pre-Knowledge Requirement: The "ANY" domain controller option requires vCenter to have prior knowledge of the DC identities. This would necessitate manually adding leaf certificates for all participating DCs during configuration, which does not reduce administrative overhead.

Resolution

Providing the Domain Controller SSL certificate is a must for vCenter LDAPS configuration.

Additional Information

Per Broadcom architectural design, if you are updating or replacing the SSL certificate for an active identity source, the identity source must be completely removed and re-added to apply the changes.

Reference: KB 316596