How to Generate a CSR for VCF Automation 9.1 in VCF Operations

Products

• VCF Automation

Issue/Introduction

This article provides the procedure to generate a Certificate Signing Request (CSR) for VCF Automation 9.1 using VCF Operations.

When generating a CSR, the public key and Subject Alternative Names (SANs) are embedded in the CSR, while the corresponding private key is retained in the VCF Operations keystore. When the CA-signed certificate is imported in VCF Operations, the certificate is validated with the stored private key.

Environment

VCF Automation 9.1

Resolution

Step 1: Navigate to Certificate Management

1. Log in to VCF Operations.
2. From the navigation bar at the top, click Manage.
3. In the left pane, navigate to Fleet management > Certificates.
4. On the VCF Management page, filter for the VCF Automation component.

Step 2: Initiate CSR Generation

  5. Select the VCF Automation component and, from the ellipsis drop-down menu, select Generate CSR.

Step 3: Configure CSR Settings

  In the Generate CSR window, configure the following settings and click Generate:

Option	Description
Organization	Type the name under which your company is known. The listed organization must be the legal registrant of the domain name in the certificate request.
Organizational Unit	Use this field to differentiate between divisions within your organization with which this certificate is associated.
Country	Select the country name where your company is legally registered.
State/Province	Type the full name (do not abbreviate) of the state, province, region, or territory where your company is legally registered.
Locality	Type the city or locality where your company is legally registered.
Email Address	Optionally, enter a contact email address.
Key Size	Select the key size (2048 bit, 3072 bit, or 4096 bit) from the drop-down menu.
Common Name	Enter the VCF Automation FQDN.
Subject Alternative Name (SAN)	Enter the VCF Automation FQDN and Cluster VIP IP addresses. If the same certificate will be used for the VCF Services Runtime on the VCF Automation cluster, you must also include the VCF Services Runtime FQDN in the SAN list.
IP Name	Enter the IP addresses of the component as a comma-separated list without any spaces or line breaks. Example: <ipaddress>,<ipaddress> Do not use: <ipaddress>, <ipaddress>

6. Click Generate.
   
   
7. Download the generated CSR and submit it to your Certificate Authority (CA).

 

 

Additional Information

• Verify all required FQDNs and VIPs are added to the SAN list before submitting the CSR to avoid certificate validation failures.
  
  
• Follow the exact formatting for IPs to avoid validation errors during CSR generation.
  
  
• Do not generate a new CSR after submitting to CA, as it will overwrite the private key stored in VCF Operations.