Machine SSL certificate replacement with custom CA-signed certificate via vSphere client UI for vCenter
search cancel

Machine SSL certificate replacement with custom CA-signed certificate via vSphere client UI for vCenter

book

Article ID: 403973

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

To ensure the vCenter Server environment remains secure and compliant with corporate policies, use the vSphere Client to replace the Machine SSL certificate with a Custom Certificate Authority (CA) signed certificate.

Note: Broadcom does not support wildcard certificates on vCenter Server. Refer to Certificate Requirements for the Different Solution Paths.

Environment

  • vCenter Server 7.x
  • vCenter Server 8.x
  • vCenter Server 9.x

Resolution

Prerequisites

  • Take a snapshot of the vCenter before performing this activity. If the vCenter is in linked mode, take offline snapshots of all the linked vCenter together.
  • vCenter High Availability (VCHA) must be disabled before rotating certificates

Certificate Replacement

  1. Generate the Certificate Signing Request (CSR)

    Note:     When using a Microsoft Certificate Authority which has not been configured with a template, refer to the article Creating a Microsoft Certificate Authority Template for SSL Certificate Creation in vSphere 6.x/7.x
    1. Log in to the vSphere Web Client as [email protected] or a user in the CAAdmins vCenter Single Sign-On group.
    2. Navigate to Home > Administration > Certificate Management.
    3. Under the Machine SSL tab, select the radio button next to the vCenter Server certificate.
    4. Click Generate Certificate Signing Request (CSR).

      Important: Ensure that the Primary Network Identifier (PNID) matches the hostname. To verify, run the following command on the vCenter Server:

      /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost && hostname -f
       

      Note      : Refer to the information below to enter values for CSR generation.

      Field

      Description

      Common Name

      Fully Qualified Domain Name (FQDN) of the vCenter Server

      Organization

      Company name

      Organizational Unit

      Department name, e.g., IT

      Country

      Two-letter country code (e.g., US)

      State/Province

      The state or province where the organization is located

      Locality

      The city where the organization is located

      Email

      Contact email address

      Host

      Fully Qualified Domain Name (FQDN) of the vCenter Server

      Subject Alternative Name (SAN)

      FQDN(s), short hostname, and IP address—comma-separated (e.g., vcsa.domain.local,vcsa,192.x.x.x)


       
  2. Submit CSR to Certificate Authority
    1. Submit the generated vmca_issued_csr.csr to a third-party CA to obtain the Machine SSL certificate.
    2. Save the signed certificate as: machine_name_ssl.cer. For more details, refer to: Obtaining vSphere Certificates from a Microsoft Certificate Authority.

  3. Prepare Certificate Files

    Note:     If there are one or more intermediate certificate authorities, the "chain.cer" should be a chain of all intermediate CA and Root CA certificates. The "machine_name_ssl.cer" should include the machine cert only.

    Format the certificates into the correct structure:
    • Machine SSL Certificate File (machine_name_ssl.cer)
      -----BEGIN CERTIFICATE-----
      <alphanumeric certificate characters>       <-----Machine SSL Certificate
      -----END CERTIFICATE-----

    • Chain File (chain.cer):
      -----BEGIN CERTIFICATE-----
      <alphanumeric certificate characters>    <----- Intermediate Certificate
      -----END CERTIFICATE-----
      -----BEGIN CERTIFICATE-----
      <alphanumeric certificate characters>    <----- Root Certificate
      -----END CERTIFICATE-----

      Note      : In some cases, an "Issuer Certificate" may also be provided. This is treated as an intermediate certificate and should be included in the chain in the exact order received from the CA.
      -----BEGIN CERTIFICATE-----
      <alphanumeric certificate characters>    <----- Issuer Certificate
      -----END CERTIFICATE-----
      -----BEGIN CERTIFICATE-----
      <alphanumeric certificate characters>    <----- Intermediate Certificate
      -----END CERTIFICATE-----
      -----BEGIN CERTIFICATE-----
      <alphanumeric certificate characters>    <----- Root Certificate
      -----END CERTIFICATE-----

  4.  Import the Certificate into vCenter
    1. Return to Certificate Management in the vSphere Web Client.
    2. Under the Machine SSL tab, select the vCenter Server certificate radio button.
    3. Click Import and Replace Certificate.
    4. Choose Replace with external CA certificate where CSR is generated from vCenter Server (private key embedded).
      1. However, when choosing "Replace with external CA certificate (requires private key)", you must manually extract the private key. Refer to Retrieving Private Key For A Certificate Signing Request Generated In The vSphere Client for instructions.
    5. Browse and upload the machine_name_ssl.cer under Machine SSL Certificate.
    6. Browse and upload the chain.cer under Chain of trusted root certificates. Note: Ensure there are no trailing spaces at the end of the certificate content.

    7. Acknowledge the backup warning by checking the checkbox.
    8. Click Next, review the certificate details, and click Finish to complete the replacement.

      Note:       Starting with vCenter Server 8.0 Update 2, a service restart is no longer required after a successful certificate replacement. For all prior versions, vCenter Server services will automatically restart upon completion of the certificate replacement operation.

Additional Information

Prior to certificate import, users can validate the SAN, PNID, and expiry status using the following command on the vCenter server SSH:

openssl x509 -in /path/to/certificate.crt -text -noout

Powered by Wolken Software