Renew SSL/TLS Certificates in VMware Cloud Director

Products

• VMware Cloud Director
• VMware Telco Cloud Platform
• VMware NSX

Issue/Introduction

• This article provides instructions on how to replace certificates for VMware Cloud Director before 10.3.x version.
• Instruction to replace certificate in VCD NSX-T Load Balancer server

Environment

VCD 10.3.3

TCP 5.0.1

NSX-T 3.2

Resolution

To renew \ replace VCD certificate in appliance cell and VCD LB , we have two step procedure:

Step 1: Replacing certificate in VCD appliance:

• For VCD after 10.3.3 version and for self signed certificate refer How to Replace the Public/HTTPS Certificate in VMware Cloud Director
• For VCD before 10.3 and for 10.3, refer below steps for custom certificate:
  1. Create the key files for both http and consoleproxy, by running the following:
     

     openssl genpkey -out user.http.key -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes256 -pass pass:'securepassphrase'
     cp user.http.key user.consoleproxy.key

  2. Create a config file to be used with OpenSSL to create CSR, this can be achieved by updating the following command under the [req_distinguished_name] and [alt_names] sections in-line with your environment.
     

     cat > vcd_csr.cfg <<EOF
     [req]
     distinguished_name = req_distinguished_name
     req_extensions = v3_req
     prompt = no
     [req_distinguished_name]
     C = GB
     ST = Greater London
     L = London
     O = THMB
     OU = VMware
     CN = *.thmb.local
     [v3_req]
     subjectAltName = @alt_names
     [alt_names]
     DNS.1 = *.thmb.local
     EOF

  3. Create the CSR using the generated key file, by running the following command:
     

     openssl req -new -key user.http.key -config vcd_csr.cfg -out user.wildcard.csr -passin pass:'securepassphrase'

  4. Verify the CSR generated is correct:
     

     openssl req -text -noout -verify -in user.wildcard.csr

  5. Share the generated .csr files to Certificate authority team to generate certificate files.
  6. Once you receive the certificate from CA team, combine your root, intermediate and server certificate as .pem file using below command:
     

     cat \
     /opt/vmware/vcloud-director/data/transfer/wildcard_cert.cer \
     /opt/vmware/vcloud-director/data/transfer/ca_inter_cert.cer \
     /opt/vmware/vcloud-director/data/transfer/ca_root_cert.cer \
     > user.http.pem
     
     cat \
     /opt/vmware/vcloud-director/data/transfer/wildcard_cert.cer \
     /opt/vmware/vcloud-director/data/transfer/ca_inter_cert.cer \
     /opt/vmware/vcloud-director/data/transfer/ca_root_cert.cer \
     > user.consoleproxy.pem

      

  7. Change the owner of the file, by referring below command:
      

     chown vcloud.vcloud /opt/vmware/vcloud-director/data/transfer/user.http.pem
     chown vcloud.vcloud /opt/vmware/vcloud-director/data/transfer/user.http.key
     chown vcloud.vcloud /opt/vmware/vcloud-director/data/transfer/user.consoleproxy.pem
     chown vcloud.vcloud /opt/vmware/vcloud-director/data/transfer/user.consoleproxy.key

  8. Change permission of the files:
     

     chmod 0750 /opt/vmware/vcloud-director/data/transfer/user.http.pem
     chmod 0750 /opt/vmware/vcloud-director/data/transfer/user.http.key
     chmod 0750 /opt/vmware/vcloud-director/data/transfer/user.consoleproxy.pem
     chmod 0750 /opt/vmware/vcloud-director/data/transfer/user.consoleproxy.key

  9. Import the certificates to primary, standby cells:
     

     /opt/vmware/vcloud-director/bin/cell-management-tool certificates -j \
     --cert /opt/vmware/vcloud-director/data/transfer/user.http.pem \
     --key /opt/vmware/vcloud-director/data/transfer/user.http.key \
     --key-password 'securepassphrase'
     
     /opt/vmware/vcloud-director/bin/cell-management-tool certificates -p \
     --cert /opt/vmware/vcloud-director/data/transfer/user.consoleproxy.pem \
     --key /opt/vmware/vcloud-director/data/transfer/user.consoleproxy.key \
     --key-password 'securepassphrase'

  10. Re-start the VCD service to take effect of newly updated certificate.

Step 2: Replace VCD LB service certificate:

1. To update certificate in NSX-T LB refer Renewing expired NSX LB certificates in UI
2. once updated, refer below steps to update public address in VCD UI:
   1. From the VCD provider UI, go to Administration > Settings >  Public Addresses. Review the Web Portal certificate chain and API certificate chain applied. Update the certificate to match the correct public/web certificate.

 

Additional Information

Configure VMware Cloud Director Public Addresses.