How to download and install vCenter Server root certificates to avoid Web Browser certificate warnings
search cancel

How to download and install vCenter Server root certificates to avoid Web Browser certificate warnings

book

Article ID: 330833

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

When you use the vSphere Client to connect to a vCenter Server system, your Web browser displays a message similar to:
  • There is a problem with this website's security certificate
  • The connection is not private
  • This connection is untrusted
  • ERR_CERT_AUTHORITY_INVALID
  • NET:ERR_CERT_AUTHORITY_INVALID
Note: If you see a similar error in vCloud Director see Repairing a VMware Cloud Director Appliance that was re-initialized.
The precise message depends on your Web browser. To resolve this issue, you have to download the root certificates from the vCenter Server that you are targeting and install it on the machine on which you are running the browser that accesses the vSphere  Client.

Environment

VMware vCenter Server 6.5.x
VMware vCenter Server 7.0.x
VMware vSphere ESXi 6.0
VMware vCenter Server 6.7.x
VMware vCenter Server Appliance 6.5.x
VMware vCenter Server Appliance 6.7.x
VMware vSphere ESXi 7.0.0

Resolution

This issue can be resolved depending on the environment at your site, on whether VMCA is an intermediate certificate, and on whether your Web browser uses the operating system certificate store (Internet Explorer, Chrome) or manages its own certificate store (Firefox).

Note: You need to connect to the vCenter Server FQDN on environments with External Platform Services Controllers, as the option to "Download trusted root CA certificates" is only available on vCenter Server Appliance URL (whether it is Embedded PSC or Management Node)

Certificate Download in Small Deployments

This procedure is for you if your environment has these characteristics:
  • A Web browser that uses the operating certificate store on Windows (such as Internet Explorer or Google Chrome).
  • A small deployment with one or two client machines that connect to a vCenter Server installation.
  • Use of default certificates or custom certificates.

You can download the VMware Certificate Authority (VMCA) root and leaf certificates and then add them to the operating system root store of the system from which you are connecting to the vCenter Server system. Relation Information section in this KB has an example with screenshots.

  1. From a client system Web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension.

    For example:
    https://vcenter.domain.com/

    Note: Direct URL to download the Certificate is https://vCenter_FQDN/certs/download.zip (Example - https://vcenter.domain.com/certs/download.zip). From Linux machines, wget command can be used to download the Certificates, Example - "wget https://vcenter.domain.com/certs/download.zip". Screenshots of both methods available in Related Information section of this KB.
     
  2. Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
  3. Change the extension of the file to .zip.
    The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS).
  4. Extract the contents of the ZIP file.
    The result is a .certs folder that contains two types of files. Files with a number as the extension (.0, .1, and so on) are root certificates. Files with an extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate.
  5. Install the certificate files as trusted certificates by following the process that is appropriate for your operating system.
    For most Microsoft Windows systems, you can follow the instructions at https://technet.microsoft.com/en-us/library/cc754841.aspx

Firefox has its own trusted roots store and does not use the operating system store. If you are working with Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click Certificates to import the certificate into Firefox.

Active Directory Group Policy Update in Deployments with VMCA as an Intermediate Certificate Authority

This procedure is for you if your environment has these characteristics:

  • A Web browser that uses the operating certificate store on Windows (such as Internet Explorer and Google Chrome)
  • The vCenter Server system is accessed from several different machines,
  • VMCA is set up to be an intermediate CA.

You can import the root certificate into the group policy of your Active Directory environment to make the certificates trusted in your Active Directory domain. After the certificates are trusted, the browser error no longer appears on any machine that is part of the Active Directory domain.

  1. From a client system Web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension.

    For example:
    https://vcenter.domain.com/

    Note: Direct URL to download the Certificate is https://vCenter_FQDN/certs/download.zip (Example - https://vcenter.domain.com/certs/download.zip). From Linux machines, wget command can be used to download the Certificates, Example - "wget https://vcenter.domain.com/certs/download.zip"
     
  2. Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
  3. Change the extension of the file to .zip.
    The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS)
  4. Extract the ZIP file.
    The result is a .certs folder that contains two types of files. Files with a number extension (.0, .1, and so on) are root certificates. Change the extension to .crt. Files with a extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate. Change the extension to .crl.
  5. Open the Active Directory Group Policy Management Editor.
  6. Open Public Key Policies and select Intermediate Certification Authorities.
  7. Add the certificate file or files that you downloaded.
  8. From you Windows command prompt, run gpupdate /force to force an update.

Firefox has its own trusted roots store and does not use the operating system store. If you are working with Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click Certificates to import the certificate into Firefox.

Active Directory Group Policy Update in Deployments with Custom Certificates or VMCA-Signed Certificates

This procedure is for you if your environment has these characteristics:

  • A Web browser that uses the operating certificate store on Windows (such as Internet Explorer and Google Chrome).
  • The vCenter Server system is accessed from several different machines.
  • You use a root certificate from a CA that is not trusted in your environment. That CA can be VMCA or a different CA that is not trusted.
You can import the root certificate into the group policy of your Active Directory environment to make the certificates trusted in your Active Directory domain. After you do that, the browser error no longer shows up on any machine that is part of the Active Directory domain.
  1. From a client system Web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension.

    For example:
    https://vcenter.domain.com/

    Note: Direct URL to download the Certificate is https://vCenter_FQDN/certs/download.zip (Example - https://vcenter.domain.com/certs/download.zip). From Linux machines, wget command can be used to download the Certificates, Example - "wget https://vcenter.domain.com/certs/download.zip"
     
  2. Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
  3. Change the extension of the file to .zip.
    The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS).
  4. Extract the contents of the ZIP file.
    The result is a .certs folder that contains two types of files. Files with a number extension (.0, .1, and so on) are root certificates. Change the extension to .crt. Files with a extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate. Change the extension to .crl.
  5. Open the Active Directory Group Policy Management Editor.
  6. Open Public Key Policies and select Trusted Root Certificate Authorities.
  7. Add the certificate file or files that you downloaded.
  8. From you Windows command prompt, run gpupdate /force to force an update.

Firefox has its own trusted roots store and does not use the operating system store. If you are working with Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click Certificates to import the certificate into Firefox.

Additional Informatoin:
VMware Skyline Health Diagnostics for vSphere - FAQ

Additional Information

Following example shows the steps to download the root certificates and then add them to the operating system root store of the system from which you are connecting to the vCenter Server system:
 
  • From a client system Web browser, go to the base URL of the vCenter Server system or the vCenter Server Virtual Appliance without appending port numbers or 'vsphere-client' extension
     
  • Right Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file using Save Link as and enter a path to save the file (you may also download the file by Clicking the download link) 
  • Downloaded file Download.zip is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS), 
  • Extract the contents of the ZIP file. The result is a certs folder that contains two types of files. Files with a number as the extension (.0, .1, and so on) are root certificates. Files with an extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate.
  • Install the certificate files as trusted certificates by following the process that is appropriate for your operating system. For most Microsoft Windows systems, you can follow the instructions at https://technet.microsoft.com/en-us/library/cc754841.aspx. Following is an Example:
    • Click Start, click Start Search, type mmc, and then press ENTER
    • On the File menu, click Add/Remove Snap-in 
    • Select Certificates,and then click Add
    • Select Computer Account -> Click Next -> Select Local Computer -> Click on Finish -> Click OK
    • Select Certificates under Trusted Root Certification Authorities and Right Click -> Select All Tasks -> Click Import
    • Click Next
    • Enter the path of downloaded Certificate and Click Next
    • Select the Certificate Store and Click Next (proceed with the default selection)
    • Verify the details and Click Finish
    • If Successful you will get a message as below, repeat the same for each Trusted Certificate
Following screenshot shows an example to directly download the Certificates (here Microsoft Edge is used):




Following screenshot shows an example to directly download the Certificates using "wget" (VCSA is used in this example) :



Powered by Wolken Software