In my previous post i have explained on how to replace VMCA SSL certificate on on vCSA 6.7 with embedded PSC , this post I will be sharing the information on replacing self-signed certificate by a Certificate Authority (CA) signed SSL certificates in a vCenter External PSC 6.7 environment.
The vSphere Certificate Manager utility provides all workflows to replace or regenerate the Machine SSL Certificate, Solution User Certificates and the VMCA Root Signing Certificate on the vCenter Server and Platform Services Controller.
Note :- If you don’t have a template Refer this Post for creating a new Template
Login to vCSA by using SSH or Console
Run /usr/lib/vmware-vmca/bin/certificate-manager and select the operation option 1
Note:-This console is already in bash shell so it didn’t asked type shell to access console , in you case it may asked you type shell to access
Enter administrator credentials and enter option number 1.
Specify the following options:
Once the private key and the request is generated select Option 2 to exit
Next we have to export the Request and key from the location , we will user win scp for this operation .
To perform export we need additional permission on PSC , type the following command for same
Note :- To perform export we need additional permission on PSC , type the following command for same
#chsh -s /bin/bash root
Once connected to PSC from winscp tool navigate the path you have mentioned on the request and download the vmca_issued_csr.csr file
Open the Certificate Server URL using this format http://FQDN or IP /CertSrv/ from browser and select Request a certificate option
Select Advanced certificate request
Open the exported vmca_issued_csr.csr file in a notepad and copy the contents and paste ob the Column Based-64-encoded certificate Request , Select the appropriate Certificate template , here I choose vSphere 6.7 and Click on Submit
From Next Page Select the Base 64 encoded option and Download the Certificate and Certificate Chain
Note :- You have to export the Chain certificate to .cer extension , by default it will be PKCS#7
Open Chain file by right click or double click navigate the certificate -> right click -> All Tasks -> export and save it as filename.cer
Also you have to export the Certificate Server certificate .
Next you have export the newly downloaded certificates to PSC Appliance ( PSC , Chain , CA root certificates )
Login to PSC appliance using winscp and copy to location .
Note:- Remember path where you copied the new certificates , it is required for replacing menu .
Login to vCenter Server Appliance Console or using putty
Go to the path where you copied the certificates change the new PSC certificate to root-ca.cer ( Not mandatory , you can eep the same same )
Rename # mv /tmp/certnew.cer /tmp/root-ca.cer
Now you add the CA server certificate data to your new renamed PSC certificate
Now will replace the certificate
Run /usr/lib/vmware-vmca/bin/certificate-manager and select the operation option 1
Enter administrator credentials and enter option number 2
Add the exported certificate and generated key path from previous steps and Press Y to confirm the change
It will take little time to complete and you can see message
Status : 100 % Completed [All tasks completed successfully]
Note:- If you are providing different certificate instead of chain certificate in Custom certificate for machine SSL option you will get error with "depth lookup:certificate"
Also if CA server certificate data is not added to PSC root certificate and available locally on same path you may face below error
Now Connect to the vCenter using Web Client and you can see the new custom certificate
Thank you for reading this post , Share the knowledge if you feel worth sharing it.
Check more vSphere 6.7 Posts
Nakivo has released its new Backup and Replication solution Nakivo v10.8, which includes support for…
Oracle Cloud VMware Solution (OCVS) provides a customer-managed, native VMware-based cloud environment hosted in Oracle…
Vinchin is a professional provider of data protection solutions for enterprises. It provides a series…
In my previous blog post, I have explained about VMware Cloud Disaster Recovery (VCDR) Onboarding and…
vRealize Network Insight helps you build an optimized, highly available, and secure network infrastructure across…
Can you believe it's here again? SysAdmin Day is back, and with it comes endless gratitude…