Regenerate vSphere 6.x, 7.x, and 8.0 certificates using self-signed VMCA

Products

VMware vCenter Server

Issue/Introduction

This article provides steps to regenerate the vSphere 6.x, 7.x, and 8.0 certificates using a new self-signed certificate in the VMware Certificate Authority (VMCA).

Note: This process can be useful to quickly recover from a scenario where the vCenter Server certificates have expired.

Environment

VMware vCenter Server 8.0
VMware vSphere 6.x
VMware vCenter Server 7.0.x

Resolution

Ensure that the STS certificate is valid before regenerating the certificate using Certificate Manager.
If STS is expired or corrupted, certificate regeneration will fail due to Service dependencies failure to start without a valid token.
This task replaces the VMCA Root Certificate with a new self-signed certificate and then the MachineSSL and Solution User certificates with new certificates issued by the VMCA.
If running an external Platform Services Controller, you need to run the vSphere 6.x Certificate Manager on the external vCenter Server 6.x and perform these tasks:
- Replace Machine SSL certificate with VMCA Certificate (Option 3)
- Replace Solution user certificates with VMCA certificates (Option 6)

Note: Certificate Replacement with the below steps will fail and rollback if the STS Certificate (Signing Certificate) is expired. Follow the below KB, checking the expiration of the STS certificate on vCenter Server to verify the validity of the STS Certificate, which includes the links to KBs for STS Certificate replacement if it is already expired.

Follow the below steps to replace other Certificates after replacing the STS Certificate.

Note: Take a snapshot or a backup of the vCenter before proceeding.

To regenerate the vSphere 6.x certificates using a new self-signed VMware Certificate Authority certificate:

Launch the vSphere 6.x Certificate Manager.

For vCenter Server 6.x/7.x Appliance: /usr/lib/vmware-vmca/bin/certificate-manager
For Windows vCenter Server 6.x: C:\Program Files\VMware\vCenter Server\vmcad\certificate-manager
Select Option 4 (Regenerate a new VMCA Root Certificate and replace all certificates)

Note: Selecting Option 8 (Reset all Certificates), both options perform the same functionality. (The difference is that option 8 does not perform automatic Rollback of the certificates). Option 8 is needed when both the Machine SSL certificate and Solution users certificates are expired.
Type the [email protected] password when prompted.
If this is the first time VMCA certificates are re-generated on this system, there will be a prompt to configure the certool.cfg file. On subsequent tasks, these values can be re-used.

Note: These values are used to define certificates issued by VMCA.

Enter these values as prompted by the VMCA (See Step 5 to confirm the Name/Hostname/VMCA):

Please configure certool.cfg file with proper values before proceeding to next step.
Press Enter key to skip optional parameters or use Default value.
Enter proper value for 'Country' [Default value : US] : (Note: Value for Country should be only 2 letters)
Enter proper value for 'Name' [Default value : CA] : (Note: As stated below, this value will be the PNID)
Enter proper value for 'Organization' [Default value : VMware] :
Enter proper value for 'OrgUnit' [Default value : VMware Engineering] :
Enter proper value for 'State' [Default value : California] :
Enter proper value for 'Locality' [Default value : Palo Alto] :
Enter proper value for 'IPAddress' [optional] :
Enter proper value for 'Email' [Default value : [email protected]] :
Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] :
Enter proper value for VMCA 'Name': (Note: This information will be requested from vCenter Server 6.0 U3, 6.5 and later builds, you may use the FQDN/PNID of vCenter Server for this field. It will be used as a Common Name for the VMCA Root Certificate)
Type Yes (Y) to the confirmation request to proceed.

You are going to regenerate Root Certificate and all other certificates using VMCA
Continue operation : Option[Y/N] ? : Y

Note: This step automatically restarts the vCenter Server services. Additionally, the Name, Hostname, and VMCA values should match the Primary Network Identifier (PNID) of the node where the Certificates are being replaced. The PNID should always match the Hostname. In order to obtain the PNID please run these commands:

For vCenter Server Appliance (VCSA)
/usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost

IMPORTANT:
If the vCenter's PNID and hostname are configured as 'localhost' (this is a not recommended configuration):
- Do not use 'localhost' when prompted to add alternate SAN (Subject Alternative Name) names to the certificate.
- For vCenters accessed by IP address: Be sure to include the vCenter's IP address when prompted to the certificate.
- Adding an IP address is optional for certs that use valid FQDN names.

For Windows vCenter Server
C:\Program Files\VMware\vCenter Server\vmafdd\" vmafd-cli.exe get-pnid --server-name localhost

After successfully regenerating the certificates.

Login to vCenter and check if there is a "Certificate Status" alarm.
If there is an alarm then clear vCenter certificate backup store using the steps mentioned in KB Certificate alarm - Clearing BACKUP_STORES certificates in the VCSA
Login back to vCenter and reset the "Certificate Status" alarm to green as this alarm will not reset on its own.