Automated Certificate Generation Fails for Microsoft CA Integration

Products

• VCF Operations
• VMware Cloud Foundation

Issue/Introduction

• The automated certificate generation process in VCF 9.1 fails when integrated with Microsoft Certificate Authority (CA). The certificate task REPLACE_CERTIFICATE fails, and logs indicate the SDDC Manager cannot process the response from the Microsoft CA.
  
  /var/log/vmware/vcf/operationsmanager/operationsmanager.log

• • Error Code: certificate.generation.failed
  • Exception: com.vmware.vrealize.lcm.plugin.common.vrops.exceptions.CertificateGenericException: Unable to generate Certificate using an existing CSR
  • Log error: Failed to convert certificate from pkcs7 to pem encoding
  • The CA web enrollment proxy returns raw ASP code instead of the expected binary certificate data when accessed via curl.

Environment

VCF 9.x

Cause

The Microsoft CA Web Enrollment service (IIS) is not configured to correctly execute ASP scripts. When queried for a certificate, the web server returns the ASP script code as text instead of executing it and returning the certificate chain.

Resolution

1. Access the Microsoft CA host server.
2. Validate the ASP role service in IIS Manager.
3. Ensure that ASP script execution is enabled for the CA web enrollment virtual directory.
4. If the issue persists, run the following command on the CA host to re-register the ASP handler mapping: aspnet_regiis -i
5. Perform a verification curl command from a remote terminal to ensure the CA is returning the correct output: curl -kI 'https://<CA_HOST>/certsrv/certnew.p7b?ReqID=CACert&Enc=b64' -u '<USER>:<PASSWORD>'
   1. HTTP 200 OK: Configuration successful.
   2. HTTP 404.3: ASP role service inactive.
   3. HTTP 500.21: Handler mapping misconfiguration.

Additional Information

Ensure IIS roles for the Microsoft CA are properly configured before attempting the automated workflow again.