After getting super annoyed with clicking “Advanced” and then “Proceed to vCenter (unsafe)” every single time I needed to go to the vSphere Web Client it was time for me to solve this once and for all.
Let’s get started!
Pre-requisites
Generate Certificate Signing Request (CSR)
SSH to your vCenter Server when using vCenter with the Embedded Platform Service Controller (PSC) or SSH to PSC when using the external PSC.
Enable the BASH shell and set it to the default shell (link).
Run /usr/lib/vmware-vmca/bin/certificate-manager and Select Option 2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
root@vcenter [ ~ ]# /usr/lib/vmware-vmca/bin/certificate-manager _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ | | | *** Welcome to the vSphere 6.0 Certificate Manager *** | | | | -- Select Operation -- | | | | 1. Replace Machine SSL certificate with Custom Certificate | | | | 2. Replace VMCA Root certificate with Custom Signing | | Certificate and replace all Certificates | | | | 3. Replace Machine SSL certificate with VMCA Certificate | | | | 4. Regenerate a new VMCA Root Certificate and | | replace all certificates | | | | 5. Replace Solution user certificates with | | Custom Certificate | | | | 6. Replace Solution user certificates with VMCA certificates | | | | 7. Revert last performed operation by re-publishing old | | certificates | | | | 8. Reset all Certificates | |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _| Note : Use Ctrl-D to exit. |
Select Y.
|
1 |
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : Y |
Provide the SSO and vCenter privileged user credentials.
|
1 2 3 |
Please provide valid SSO and VC priviledged user credential to perform certificate operations. Enter username [Administrator@vsphere.local]: Enter password: |
NOTE Anyone noticed the typo? 🙂
Now comes the part where you have to pay attention, configure the config files for the CSRs.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 |
Please configure MACHINE_SSL_CERT.cfg with proper values before proceeding to next step. Press Enter key to skip optional parameters or use Default value. Enter proper value for 'Country' [Default value : US] : NL Enter proper value for 'Name' [Default value : CA] : vcenter Enter proper value for 'Organization' [Default value : VMware] : Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : Enter proper value for 'State' [Default value : California] : Enter proper value for 'Locality' [Default value : Palo Alto] : Enter proper value for 'IPAddress' [optional] : x.x.x.x Enter proper value for 'Email' [Default value : email@acme.com] : Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter Please configure machine.cfg with proper values before proceeding to next step. Press Enter key to skip optional parameters or use Default value. Enter proper value for 'Country' [Default value : US] : NL Enter proper value for 'Name' [Default value : CA] : vcenter Enter proper value for 'Organization' [Default value : VMware] : Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : Enter proper value for 'State' [Default value : California] : Enter proper value for 'Locality' [Default value : Palo Alto] : Enter proper value for 'IPAddress' [optional] : x.x.x.x Enter proper value for 'Email' [Default value : email@acme.com] : Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter Please configure vsphere-webclient.cfg with proper values before proceeding to next step. Press Enter key to skip optional parameters or use Default value. Enter proper value for 'Country' [Default value : US] : NL Enter proper value for 'Name' [Default value : CA] : vcenter Enter proper value for 'Organization' [Default value : VMware] : Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : Enter proper value for 'State' [Default value : California] : Enter proper value for 'Locality' [Default value : Palo Alto] : Enter proper value for 'IPAddress' [optional] : x.x.x.x Enter proper value for 'Email' [Default value : email@acme.com] : Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter Please configure vpxd.cfg with proper values before proceeding to next step. Press Enter key to skip optional parameters or use Default value. Enter proper value for 'Country' [Default value : US] : NL Enter proper value for 'Name' [Default value : CA] : vcenter Enter proper value for 'Organization' [Default value : VMware] : Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : Enter proper value for 'State' [Default value : California] : Enter proper value for 'Locality' [Default value : Palo Alto] : Enter proper value for 'IPAddress' [optional] : x.x.x.x Enter proper value for 'Email' [Default value : email@acme.com] : Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter Please configure vpxd-extension.cfg with proper values before proceeding to next step. Press Enter key to skip optional parameters or use Default value. Enter proper value for 'Country' [Default value : US] : Enter proper value for 'Name' [Default value : CA] : vcenter Enter proper value for 'Organization' [Default value : VMware] : Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : Enter proper value for 'State' [Default value : California] : Enter proper value for 'Locality' [Default value : Palo Alto] : Enter proper value for 'IPAddress' [optional] : x.x.x.x Enter proper value for 'Email' [Default value : email@acme.com] : Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter |
Select Option 1.
|
1 2 3 4 5 |
1. Generate Certificate Signing Request(s) and Key(s) for VMCA Root Signing certificate 2. Import custom certificate(s) and key(s) to replace existing VMCA Root Signing certificate Option [1 or 2]: 1 |
Provide a path to save the CSR(s) and PrivateKey(s) to for example /tmp.
|
1 2 |
Please provide a directory location to write the CSR(s) and PrivateKey(s) to: Output directory path: /tmp |
And the last step of this is to configure the certool.cfg.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
Please configure certool.cfg with proper values before proceeding to next step. Press Enter key to skip optional parameters or use Default value. Enter proper value for 'Country' [Default value : US] : NL Enter proper value for 'Name' [Default value : CA] : Enter proper value for 'Organization' [Default value : VMware] : Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : Enter proper value for 'State' [Default value : California] : Enter proper value for 'Locality' [Default value : Palo Alto] : Enter proper value for 'IPAddress' [optional] : x.x.x.x Enter proper value for 'Email' [Default value : email@acme.com] : Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter 2016-12-06T13:56:52.257Z Running command: ['/usr/lib/vmware-vmca/bin/certool', '--genkey', '--privkey', '/tmp/vmca_issued_key.key', '--pubkey', '/tmp/pubkey.pub'] 2016-12-06T13:56:52.445Z Done running command 2016-12-06T13:56:52.445Z Running command: ['/usr/lib/vmware-vmca/bin/certool', '--gencsr', '--privkey', '/tmp/vmca_issued_key.key', '--pubkey', '/tmp/pubkey.pub', '--config', '/var/tmp/vmware/certool.cfg', '--csrfile', '/tmp/vmca_issued_csr.csr'] 2016-12-06T13:56:52.556Z Done running command CSR generated at: /tmp/vmca_issued_csr.csr |
NOTE Do not close the certificate-manager tool!
Now open you favorite Secure Copy Tool (for example WinSCP) and download the file vmca_issued_csr.csr from the server you created it on.
Obtain the Subordinate CA Certificate from a Microsoft CA
Open your favorite browser and browse to the Microsoft Certificate Authority web interface, for example http://CAFQDN/certsrv.
Select “Request a certificate” and then select “advanced certificate request”.
Paste the content from the vmca_issued_csr.csr file in the “Saved Request” field and select the created “Certificate Template” for the vCenter Root CA and select “Submit”.
Save the generated certificate as a base64 chain file.
Open the downloaded certificate chain and export the certificates from that chain.
Here it gets interesting, the exported certificates must be merged into one certificate. This can be done from a command prompt. If you have only a CA without an intermediate CA run the following command:
|
1 |
type PSC.cer ca.cer > vmca_issued_cer.cer |
And if you have have CA with an intermediate CA run the following command:
|
1 |
type PSC.cer inter.cer ca.cer > vmca_issued_cer.cer |
Copy the vmca_issued_cer.cer back to the /tmp folder on the server that you created the CSR.
Import the CA signed certificate on your vCenter Server with Embedded PSC
Select Option 1.
|
1 2 3 4 5 6 |
CSR generated at: /tmp/vmca_issued_csr.csr 1. Continue to importing Custom certificate(s) and key(s) for VMCA Root Signing certificate 2. Exit certificate-manager Option [1 or 2]: 1 |
Provide the full path and filename for the Certificate file /tmp/vmca_issued_cer.cer and Key file /tmp/vmca_issued_key.key.
|
1 2 3 4 5 |
Please provide valid custom certificate for Root. File : /tmp/vmca_issued_cer.cer Please provide valid custom key for Root. File : /tmp/vmca_issued_key.key |
Select Y and it’s time for coffee!
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 |
You are going to replace Root Certificate with custom certificate and regenerate all other certificates Continue operation : Option[Y/N] ? : Y Get site nameCompleted [Replacing Machine SSL Cert...] default-site Lookup all services Get service default-site:904e2e86-461f-4c3b-ab02-29d7b9f95172 Don't update service default-site:904e2e86-461f-4c3b-ab02-29d7b9f95172 Get service default-site:0c4b36e1-b803-48be-b710-9dc4bb46ab41 Don't update service default-site:0c4b36e1-b803-48be-b710-9dc4bb46ab41 Get service default-site:d14de733-f491-4588-a1fc-45b23a546b39 Don't update service default-site:d14de733-f491-4588-a1fc-45b23a546b39 Get service aa467d6e-eb38-471c-bc4e-8190aa33a0da Don't update service aa467d6e-eb38-471c-bc4e-8190aa33a0da Get service f3b874c6-df4c-480d-b7a1-b0267ab1316c Don't update service f3b874c6-df4c-480d-b7a1-b0267ab1316c Get service bdfc4b40-6a5f-466b-9d55-49573cbe1ce2 Don't update service bdfc4b40-6a5f-466b-9d55-49573cbe1ce2 Get service 4029a203-eb0d-4da5-9dc3-1399868087b8 Don't update service 4029a203-eb0d-4da5-9dc3-1399868087b8 Get service f4f7a869-0d6a-49d3-ad40-d2a58a84e51a Don't update service f4f7a869-0d6a-49d3-ad40-d2a58a84e51a Get service 4bfcc349-16e6-4f5b-8584-98681df684cd Don't update service 4bfcc349-16e6-4f5b-8584-98681df684cd Get service 699bde4f-3595-4afa-b0cb-cb2b40285493 Don't update service 699bde4f-3595-4afa-b0cb-cb2b40285493 Get service 81fa4f6c-bb9f-4942-8757-fdc620269ce5 Don't update service 81fa4f6c-bb9f-4942-8757-fdc620269ce5 Get service 828d2d91-5169-4001-a7ac-56edf9b13d5e Don't update service 828d2d91-5169-4001-a7ac-56edf9b13d5e Get service 560a3344-b046-4844-a9fc-3890db16fc2f Don't update service 560a3344-b046-4844-a9fc-3890db16fc2f Get service fb6664d2-13b8-49ca-adcd-667397c3f982 Don't update service fb6664d2-13b8-49ca-adcd-667397c3f982 Get service 514a2243-fa31-4d32-85cd-a28c7e95aac2 Don't update service 514a2243-fa31-4d32-85cd-a28c7e95aac2 Get service ef225d07-045f-4b47-8437-4095454c7600 Don't update service ef225d07-045f-4b47-8437-4095454c7600 Get service b0b77d1f-8d1f-446a-9d6c-c30261093969 Don't update service b0b77d1f-8d1f-446a-9d6c-c30261093969 Get service b59705bc-995c-4d8f-b9c1-d29f3235a58c Don't update service b59705bc-995c-4d8f-b9c1-d29f3235a58c Get service 92545f11-13dd-40f9-89b7-fc636ee3db94 Don't update service 92545f11-13dd-40f9-89b7-fc636ee3db94 Get service f644c69a-b9e1-4a61-9c22-1495d7cd18a6 Don't update service f644c69a-b9e1-4a61-9c22-1495d7cd18a6 Get service 8fd2b49e-5748-4dec-aaf0-b9cdf63436b6 Don't update service 8fd2b49e-5748-4dec-aaf0-b9cdf63436b6 Get service 9dee1101-4352-47a9-97c6-702f4f6db702 Don't update service 9dee1101-4352-47a9-97c6-702f4f6db702 Get service f35cc2cd-9386-4360-8c76-060ea5454e6d Don't update service f35cc2cd-9386-4360-8c76-060ea5454e6d Get service 699bde4f-3595-4afa-b0cb-cb2b40285493_kv Don't update service 699bde4f-3595-4afa-b0cb-cb2b40285493_kv Get service d9c5400c-b2b7-4d73-8beb-8f5a9738e32a Don't update service d9c5400c-b2b7-4d73-8beb-8f5a9738e32a Get service fad30743-8462-4145-bd9d-b1262b159573 Don't update service fad30743-8462-4145-bd9d-b1262b159573 Get service 261b4bca-d016-4391-bd07-8448bc21134c Don't update service 261b4bca-d016-4391-bd07-8448bc21134c Get service 3ba5142c-b6d8-481b-92c8-cf404b19d1fd Don't update service 3ba5142c-b6d8-481b-92c8-cf404b19d1fd Get service 699bde4f-3595-4afa-b0cb-cb2b40285493_authz Don't update service 699bde4f-3595-4afa-b0cb-cb2b40285493_authz Updated 0 service(s) Status : 100% Completed [All tasks completed successfully] |
Boom! 100% Completed! Now you can browse to your vSphere Web Client and enjoy the silence of no warning messages 🙂 .
Import the CA signed certificate on your vCenter when you have an external PSC
The steps to be taken are really similar to the steps above so only the steps are explained and not shown.
SSH to your vCenter Server when using vCenter with an External Platform Service Controller (PSC).
Enable the BASH shell and set it to the default shell (link)
Run /usr/lib/vmware-vmca/bin/certificate-manager and Select Option 3
Provide the SSO and vCenter privileged user credentials.
Provide the PSC IP address.
Provide the configuration file config for the vCenter Server.
Select Y and yes it’s time for coffee again!
Could you please take a look at this article once again.
>Here it gets interesting, the exported certificates must be merged into one certificate. This can be done from a command prompt.
>type PSC.cer inter.cer ca.cer > vmca_issued_cer.cer
Where does those file names come from, you never mentioned them? The picture next to the text also only shows two certificates, not three.
>Provide the full path and filename for the Certificate file /tmp/vmca_issued_cer.cer and Key file /tmp/vmca_issued_key.key.
Then, right below, you write totally different file names in the field – file names we’ve never seen before.
Hi,
That is correct I don’t have an intermediate CA server like most companies do, so I only have to run:
type PSC.cer ca.cer > vmca_issued_cer.cer
I’ve updated this in the article, and I’ve updated the cert file in the field thanks for noticing 🙂
Marco
Great article, really appreciate it.
Couple things I ran into just in case anyone else does too: when populating the various cfg files for the CSR the “name” field for each service was identical (vcenter). I had to use a unique “name” for each or when I imported the signed cert back in those services would fail to restart with the new cert and the vmca script would revert everything back to the default self-signed. I just used the service name (machine_ssl, machine, webclient, vpxd, vpxd-ext, etc) and it worked like a champ.
Also, if there anyone as OCD as I am, the “Issued To” field on the final certificate after your CA has issued it is populated from the “Name” field on the final .cfg (certool.cfg) when generating the CSR.
Hi,
First of all thanks for the good article – unfortunatly I do have a problem and you might have an idea whats wrong?
I did a fresh install of the VCSA 6.5U1 after running
“Run /usr/lib/vmware-vmca/bin/certificate-manager and Select Option 2.”
I see the message
“Do you wish to generate all certificates using configuration file : Option[Y/N] ?”
which I can confirm with “Y” as next step I login with the correct credentials, and then I see the following message:
“certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ?”
When I confirm the this with “Y” I can see this:
“Press Enter key to skip optional parameters or use Previous value.
Enter proper value for ‘Country’ [Previous value : CH] :
etc”
I never come to a point where I can configure “MACHINE_SSL_CERT.cfg”, “machine.cfg”, etc. do you may have any idea whats wrong?
Thanks.
Here’s a thing – when I ran the cert management tool, and selected option 2, I only got prompted to customize the certool.cfg file; none of the others. So when I got my certificate, it had only default entries for Country, locality, etc..
Update: It would appear that something has changed since this article was written. It seems the Cert tool will only ask for certool.cfg entries, and then use those responses for all other certificate cfg files.
Evidently things are changed even more. When I run this, like it did for @Chuck_Stevens, it only asked me to customize certool.cfg. It did not ask to update any of the other config files. Also, when it ran, it did not generate the CSR using the config file.
My script output is:
Output directory path: /vmca_temp
2018-02-06T21:27:28.241Z Running command: [‘/usr/lib/vmware-vmca/bin/certool’, ‘–genkey’, ‘–privkey’, ‘/vmca_temp/vmca_issued_key.key’, ‘–pubkey’, ‘/tmp/pubkey.pub’]
2018-02-06T21:27:28.442Z Done running command
2018-02-06T21:27:28.443Z Running command: [‘/usr/lib/vmware-vmca/bin/certool’, ‘–gencsrfromcert’, ‘–privkey’, ‘/vmca_temp/vmca_issued_key.key’, ‘–cert’, ‘/var/lib/vmware/vmca/root.cer’, ‘–csrfile’, ‘/vmca_temp/vmca_issued_csr.csr’]
2018-02-06T21:27:28.468Z Done running command
CSR generated at: /vmca_temp/vmca_issued_csr.csr
But when I decoded the CSR, it was using the default VMware config.
So I manually ran the command adding the –config command:
/usr/lib/vmware-vmca/bin/certool –gencsr –privkey /temp_vcma/vmca_issued_key.key –pubkey /tmp/pubkey.pub –config /var/tmp/vmware/certool.cfg –csrfile /temp_vmca/vmca_issued_csr.csr
I decoded the new CSR and it correctly used my options so I submitted it to my ADCS and retrieved a new certificate. I uploaded the certificate and applied it to the VMCA and the script started executing, however it failed with:
Error while reverting certificate for store : MACHINE_SSL_CERT
Rollback Status : 0% Completed [Rollback operation failed]
Error while performing rollback operation, please try Reset operation…
please see /var/log/vmware/vmcad/certificate-manager.log for more information.