Prestage root and intermediate certificates in Aria Lifecycle Manager

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VMware vRealize Suite Lifecycle Manager 8.x
• VMware Cloud Foundation

Issue/Introduction

• Preparing to migrate to a new Certificate Authority (CA)

• Prestaging root and intermediate CA certificates in LCM is required prior to CA cutover to prevent SSL/TLS handshake failures, broken API integrations, or endpoint rejections.

Environment

LCM: 8.18

VCF: 5.2

Resolution

1. Take a snapshot of the LCM appliance via vCenter

2. Import the new root/intermediate CA certificates to the cacerts trust stores using the following commands:

   • keytool -import -alias <alias_name> -file /tmp/<cert.pem> -keystore /usr/lib/jvm/OpenJDK-1.11.0/lib/security/cacerts -storepass changeit -noprompt

   • keytool -import -alias <alias_name> -file /tmp/<cert.pem> -keystore /usr/java/jre-vmware/lib/security/cacerts -storepass changeit -noprompt

   • Note: You will want to run both of these commands once for the Root CA, and once for each Intermediate CA.

3. Confirm the new CA certificates were successfully imported:

   • keytool -list -v -keystore /usr/lib/jvm/OpenJDK-1.11.0/lib/security/cacerts -storepass changeit -alias <alias_name>

   • keytool -list -v -keystore /usr/java/jre-vmware/lib/security/cacerts -storepass changeit -alias <alias_name>

4. Gracefully restart the LCM appliance via vCenter