How to Update the Self-Signed Machine SSL Certificate in Usage Meter 9.1 Using 'cert-management.sh'

Products

• VMware Usage Meter

Issue/Introduction

This article explains the procedure to update the machine SSL certificate using cert-management.sh,
a new certificate management utility introduced in VCF Usage Meter 9.1.

Environment

VCF Usage Meter 9.1 

Cause

In VCF Usage Meter 9.0, certificate-related procedures were performed following the instructions in VCF Usage Meter Certificate Management.
Starting with VCF Usage Meter 9.1, a newly introduced certificate management utility, cert-management.sh, allows you to execute these procedures interactively.

Resolution

The procedure to update the machine SSL certificate for the Usage Meter appliance is as follows::

1. Take an offline snapshot of the Usage Meter appliance.
2. Connect to the target Usage Meter via SSH and log in as the usagemeter user.
3. Execute the following command to stop all internal VCF Usage Meter services:
   
[email protected] [ ~ ]$ stop.sh All


4. Execute the following command to display the certificate management utility:
   
[email protected] [ ~ ]$ cert-management.sh

5. Once the certificate management utility is displayed, enter 2 to start updating the self-signed machine SSL certificate.
   
   [email protected] [ ~ ]$ cert-management.sh
Welcome to VCF Usage Meter's certificate management! Available operations:
         1. Import certificate into Usage Meter's truststore (establish a trust between the
            certificate and the Usage Meter appliance). Either provide full path to the
            certificate or provide server's IP and port to obtain it dynamically.
         2. Replace Usage Meter's certificate with a new self-signed certificate
            (effectively regenerates the current certificate).
         3. Replace Usage Meter's certificate with a custom certificate.
            Need to provide full paths to following files: signed certificate and certificate's private part.
         4. Remove certificate from Usage Meter's truststore by alias.
         5. List all of the certificates from the Usage Meter's truststore.

Select the operation to perform (1, 2, 3, 4 or 5): <==== Enter 2



6. Configure the displayed options as follows:
   Note: If you do not need to change the default values, leave the field blank and press Enter to proceed.

   Available key algorithms:
  1. RSA
  2. EC
Select key algorithm (default 1 - RSA):   <==== !!!
Enter key length for RSA (2048-8192 bits, default 4096): <==== !!!
Enter validity period in days (default 730): <==== !!!
Available signature algorithms for RSA keys: <==== !!!
  1. SHA256withRSA
  2. SHA384withRSA
  3. SHA512withRSA
Select signature algorithm (default 1 - SHA256withRSA): <==== !!!

   Configuration:
        Key Algorithm: RSA
        Key Length: 4096 bits
        Validity Period: 730 days
        Signature Algorithm: SHA256withRSA

   
   Note: The update is complete when the following output is displayed.
   Generating new self-signed certificate for Usage Meter...
INFO: Backing up existing keystore
Backing up existing keystore  DONE
INFO: Updating existing certificate alias
Updating existing certificate alias == DONE
INFO: Generating 4096-bit RSA key pair
Generating 4096-bit RSA key pair ====== DONE
INFO: Generating self-signed certificate
Generating self-signed certificate = DONE
INFO: Creating new keystore
Creating new keystore == DONE
INFO: Cleaning up backup certificate
Cleaning up backup certificate = DONE
INFO: Setting keystore permissions
Setting keystore permissions = DONE

7. Enter y at the following prompt to reboot the Usage Meter appliance.
   
   Note: A reboot is required for the new certificate to take effect.
Reboot is required after replacing UM certificate. Reboot now (y/n): <=== Enter y
   
   
8. Once the reboot is complete and you have verified access to the Usage Meter Web UI, delete the snapshot taken in step 1.

Additional Information

Ref.: Certificate Management Utility for VCF Usage Meter