Replace vCenter External PSC 6.7 VMCA Certificate by an ADCS Signed Certificate

In my previous post i have explained on how to replace VMCA SSL certificate on on vCSA 6.7 with embedded PSC , this post I will be sharing the information on replacing self-signed certificate by a Certificate Authority (CA) signed SSL certificates in a vCenter External PSC 6.7 environment.

The vSphere Certificate Manager utility provides all workflows to replace or regenerate the Machine SSL Certificate, Solution User Certificates and the VMCA Root Signing Certificate on the vCenter Server and Platform Services Controller.

Requirements

Working PKI based on Active directory Certificate Server.
Certificate Server should have a valid Template for vSphere environment

Note :- If you don’t have a template Refer this Post for creating a new Template

vCenter Server Appliance with root Access

Generate a certificate request from PSC 6.7

Run /usr/lib/vmware-vmca/bin/certificate-manager and select the operation option 1

Note:-This console is already in bash shell so it didn’t asked type shell to access console , in you case it may asked you type shell to access

Enter administrator credentials and enter option number 1.

Specify the following options:

Output directory path :- path where will be generated the private key and the request
Country :- your country in two letters
Name :- The FQDN of your PSC
Organization :- an organization name
OrgUnit :- type the name of your unit
State :- country name
Locality :- your city
IPAddess :- provide the PSC IP address
Email :- provide your E-mail address
Hostname :- the FQDN of your PSC
VMCA Name :- the FQDN where is located your VMCA , here we use PSC (vCSA or PSC FQDN based on your setup)

Once the private key and the request is generated select Option 2 to exit

Next we have to export the Request and key from the location , we will user win scp for this operation .

To perform export we need additional permission on PSC , type the following command for same

Note :- To perform export we need additional permission on PSC , type the following command for same

#chsh -s /bin/bash root

Once connected to PSC from winscp tool navigate the path you have mentioned on the request and download the vmca_issued_csr.csr file

Open the Certificate Server URL using this format http://FQDN or IP /CertSrv/ from browser and select Request a certificate option

Select Advanced certificate request

Open the exported vmca_issued_csr.csr file in a notepad and copy the contents and paste ob the Column Based-64-encoded certificate Request , Select the appropriate Certificate template , here I choose vSphere 6.7 and Click on Submit

From Next Page Select the Base 64 encoded option and Download the Certificate and Certificate Chain

Note :- You have to export the Chain certificate to .cer extension , by default it will be PKCS#7

Open Chain file by right click or double click navigate the certificate -> right click -> All Tasks -> export and save it as filename.cer

Also you have to export the Certificate Server certificate .

Next you have export the newly downloaded certificates to PSC Appliance ( PSC , Chain , CA root certificates )

Note:- Remember path where you copied the new certificates , it is required for replacing menu .

Go to the path where you copied the certificates change the new PSC certificate to root-ca.cer ( Not mandatory , you can eep the same same )

Rename # mv /tmp/certnew.cer /tmp/root-ca.cer

Now you add the CA server certificate data to your new renamed PSC certificate

Now will replace the certificate

Run /usr/lib/vmware-vmca/bin/certificate-manager and select the operation option 1

Enter administrator credentials and enter option number 2

Add the exported certificate and generated key path from previous steps and Press Y to confirm the change

Custom certificate for machine SSL :- Path to the chain of certificate (srv.cer here)
Valid custom key for machine SSL :- Path to the .key file generated earlier.
Signing certificate of the machine SSL certificate :- Path to the certificate of the Root CA (root-ca.cer , generated base64 encoded PSC certificate).

It will take little time to complete and you can see message

Status : 100 % Completed [All tasks completed successfully]

Note:- If you are providing different certificate instead of chain certificate in Custom certificate for machine SSL option you will get error with "depth lookup:certificate"

Also if CA server certificate data is not added to PSC root certificate and available locally on same path you may face below error

Now Connect to the vCenter using Web Client and you can see the new custom certificate

Thank you for reading this post , Share the knowledge if you feel worth sharing it.

Check more vSphere 6.7 Posts

Follow VMarena on FaceBook , Twitter , Youtube