How to replace Aria Automation ingress certificates when Aria Suite Lifecycle 8.x is inaccessible

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article provides the steps to replace the ingress certificates for Aria Automation (vRA) using the vracli command-line interface. Use these steps when updating expiring certificates or deploying new custom certificates in environments where Aria Suite Lifecycle 8.x (LCM/vRSLCM) is inaccessible or unavailable.

Symptoms

• Ingress certificate requires replacement or renewal.
• Aria Suite Lifecycle is inaccessible or cannot be used to manage the environment.
• Administrator requires CLI-based certificate replacement via SSH to prioritize restoration of Aria Automation services.

Environment

VMware Aria Automation 8.x

VMware Aria Suite Lifecycle 8.x

Cause

Certificates in Aria Suite Lifecycle 8.x and Aria Automation have expired preventing Aria Suite Lifecycle management lifecycle functions to replace the certificate.

Resolution

Prerequisites

• SSH access to the vRA appliance nodes.
• The root or administrative credentials for the appliance.
• A valid certificate chain (PEM format).

Procedure

1. Establish an SSH session to the Aria Automation primary node/appliance.
2. Upload the new certificate files to the appliance (e.g., /tmp/).
3. Set the new certificate chain using the vracli certificate ingress command:

   vracli certificate ingress --set /path/to/certificate.pem /path/to/private-key.pem

4. Waiting for services to complete restarting as this will trigger an automatic restart of the prelude namespace.
5. Validate the status using vracli status.