Replace VCSA 6.7 Certificate (VMCA) by an ADCS Signed Certificate

In this post I will be sharing the information on replacing self-signed certificate by a Certificate Authority (CA) signed SSL certificates in a vSphere 6.7 environment. VMware has pre-packaged the vSphere Certificate Manager utility to automate the replacement process.

The vSphere Certificate Manager utility provides all workflows to replace or regenerate the Machine SSL Certificate, Solution User Certificates and the VMCA Root Signing Certificate on the vCenter Server and Platform Services Controller.

Before starting the procedure just a quick intro for managing vSphere Certificates, vSphere Certificates can manage in two different modes

VMCA Default Certificates

VMCA provides all the certificates for vCenter Server and ESXi hosts on the Virtual Infrastructure and it can manage the certificate lifecycle for vCenter Server and ESXi hosts. Using VMCA default the certificates is the simplest method and less overhead.

VMCA Default Certificates with External SSL Certificates (Hybrid Mode)

This method will replace the Platform Services Controller and vCenter Server Appliance SSL certificates, and allow VMCA to manage certificates for solution users and ESXi hosts. Also for high-security conscious deployments, you can replace the ESXi host SSL certificates as well. This method is Simple, VMCA manages the internal certificates and by using the method, you get the benefit of using your corporate-approved SSL certificates and these certificates trusted by your browsers.

Here we are discussing about the Hybrid mode, this the VMware’s recommended deployment model for certificates as it procures a good level of security. In this model only the Machine SSL certificate signed by the CA and replaced on the vCenter server and the solution user and ESXi host certificates are distributed by the VMCA.

Requirements

Working PKI based on Active directory Certificate Server.
Certificate Server should have a valid Template for vSphere environment

Note :- If you don’t have a template Refer this Post for creating a new Template

vCenter Server Appliance with root Access

Generate a certificate request from VCSA 6.7

Run /usr/lib/vmware-vmca/bin/certificate-manager and select the operation option 1

Enter administrator credentials and enter option number 1.

Specify the following options:

Output directory path :- path where will be generated the private key and the request
Country :- your country in two letters
Name :- The FQDN of your vCSA
Organization :- an organization name
OrgUnit :- type the name of your unit
State :- country name
Locality :- your city
IPAddess :- provide the vCSA IP address
Email :- provide your E-mail address
Hostname :- the FQDN of your vCSA
VMCA Name :- the FQDN where is located your VMCA. Usually the vCSA FQDN

Once the private key and the request is generated select Option 2 to exit

Next we have to export the Request and key from the location , we will user win scp for this operation .

To perform export we need additional permission on VCSA , type the following command for same

#chsh -s /bin/bash root

Once connected to vCSA from winscp tool navigate the path you have mentioned on the request and download the vmca_issued_csr.csr file .

Open the Certificate Server URL using this format http://FQDN or IP /CertSrv/ from browser and select Request a certificate option

Select Advanced certificate request

Open the exported vmca_issued_csr.csr file in a notepad and copy the contents and paste ob the Column Based-64-encoded certificate Request , Select the appropriate Certificate template , here I choose vSphere 6.7 and Click on Submit

From Next Page Select the Base 64 encoded option and Download the Certificate and Certificate Chain

Note :- You have to export the Chain certificate to .cer extension , by default it will be PKCS#7

Open Chain file by right click or double click navigate the certificate -> right click -> All Tasks -> export and save it as filename.cer

Navigate to Certificate Authority Option and verify the status of request from Issued Certificate

Next you have export the newly downloaded certificates to vCenter Appliance

Note:- Remember path where you copied the new certificates , it is required for replacing menu .

Run /usr/lib/vmware-vmca/bin/certificate-manager and select the operation option 1

Enter administrator credentials and enter option number 2

Add the exported certificate and generated key path from previous steps and Press Y to confirm the change

Custom certificate for machine SSL :- Path to the chain of certificate (srv.cer here)
Valid custom key for machine SSL :- Path to the .key file generated earlier.
Signing certificate of the machine SSL certificate :- Path to the certificate of the Root CA (root.cer , generated base64 encoded certificate).

Note:- If you are providing different certificate instead of chain certificate in Custom certificate for machine SSL option you will get error with "depth lookup:certificate"

It will take little time to complete and you can see message

Status : 100 % Completed [All tasks completed successfully]