Welcome back to vSphere 8 in the real world, and now we're going to discuss certificate management.
So certificates are used for quite a few things in a vSphere environment. Certificates are, they're pretty important.
They're pretty important to manage, to have secure, to do correctly.
VMware makes it very, very easy to use just default.
We installed this. This is what it came with. This is like a self-signed certificate.
This is what the VMware certificate manager is going to assign by default to host and just don't touch it and it will run.
The problem is that it won't necessarily be very secure because the certificates aren't signed by a trusted CA.
So any bad actor could jump in there and put in some dummy site and your system's going to tell you, I don't trust that certificate.
Well, it tells you that every time.
And so you're going to say, that's okay, ignore it and trust the certificate and let's keep going forward and log me into vCenter.
And you're going to put in credentials and you're putting credentials in to a site with a certificate you don't trust.
And you expect to not trust it, so it's okay.
And a bad actor could put a phishing site out there and, you know, steal traffic, you know, and redirect it to his site.
And you put in your single sign-on credentials for your active directory domain.
And this is going to be an account that has elevated privileges in your domain because you're logging into vCenter.
What else can you access?
Those same AD credentials.
And you can start hacking away.
So it's a good idea to actually spend some energy, some time to configure your certificate services to get a trusted certificate from a root CA that the computers in your network trust.
So you're going to get a trusted root certificate.
So you can put it into, it's going to be a certificate issuing certificate from a trusted root CA.
So that way, when vCenter issues certificates to the ESXi host and issues certificates to AutoDeploy and issues certificates to vCenter, things like that, then you will see, oh, yeah, this is a trusted certificate.
And your address bar will be green.
You know it's a trusted certificate.
The name matches the certificate name, name the address bar.
And again, from a CA that you trust.
So you should be good to go.
You should be able to continue to move forward with this and have a high level of confidence that it's really the site you think you're connecting to, as well as when your ESXi hosts talk to each other.
There's a high level of confidence between them that this really is the host I think I'm talking to, right?
Our communication is protected.
Our fault-tolerant VM communication is protected.
VM motion communication is protected.
All those kinds of things.
When I'm encrypting virtual machines, I'm using certificates from a trusted CA because my vCenter certificate management services is giving me certificates to encrypt the encryption keys I use to encrypt my virtual machines.
That key is encrypted with a certificate that we trust, right?
Things like that.
So it's a good idea for your certificate environment to be trusted.
So that means configuring your certificate management server, and that means getting a certificate issuing certificate from a trusted root CA that is trusted by your environment.
An example they use here on this slide is GoDaddy.
GoDaddy is one of many.
GoDaddy, they make it super, super easy, which is a great thing.
A lot of people use it.
GoDaddy is trusted by a lot of people.
They have a really robust infrastructure for revoking certificates if they get compromised and things like that.
But they are by far not the only one out there.
There's a lot of them out there that are reputable that you can trust, okay?
GoDaddy is just a very common one that a lot of people use just because of the convenience.
Network solutions is obviously another one that a lot of people use, a lot of people trust.
And there's a lot of them out there.
This is a couple of examples.
So certificates are used for encrypting communication between hosts, for encrypting communication between vCenter and the host, for encrypting communication between your vCenter client and the vCenter server, right?
It's for signing tokens.
It's for authentication.
So it's used for a lot of different things in your vCenter environment.
You would like to have a certificate from a root certificate authority that you trust that is going to be issuing a certificate issuing certificate to your VMware certificate authority.
So that way, when it issues certificates, they are going to be signed by that certificate, which is signed by a root CA, again, that your organization, that your environment is going to trust.
So certificate management is done in a lot of different places.
vCenter, obviously, the vCenter client is going to trust certificates, have a certificate.
vCenter itself has a certificate.
So the vCenter management utility is going to manage certificates and give certificates to your host and to your vCenter, different components like that.
There are some CLI tools that you can use for managing your certificates.
So the DIR-CLI is used for managing certificates for basically user accounts.
You can create user accounts.
You can modify, change user accounts.
You can use this tool to change users' passwords and to either assign or change a user certificate.
It is from the DIR-CLI.
The CERT tool is for managing certificates themselves that are going to be in your environment.
So you can use this to query and look at certificates, get information about expiration and things like that.
And then the VEC-SCLI, that is for your vSphere certificate services.
And that is used for, like, issuing, requesting a certificate for, like, you know, public and private key.
You can look at it to view certificate requests, things like that for managing your certificate environment from a command line.
And, of course, your web client also manages certificates, right?
So the VMCA, that is the VM certificate authority.
That's the default certificate authority in your vSphere environment, right?
That is going to be trusted by all the other devices within your vSphere environment.
It's trusted by the ESXi host and it's going to be trusted by your vCenter server, for example.
But, of course, the certificate from the ESXi host or from vCenter to your desktop isn't going to necessarily trust that.
So that's why you might want to get a certificate issuing certificate to assign to the VCMA so that your clients also trust the certificates from that environment.
Okay.
So it manages all your certificates, very low overhead, super easy.
Lots of tasks are automated within that environment.
So you don't have to worry about, you know, going in and, you know, assigning and approving and installing certificates on a bunch of machines.
Used to be before this, we would go and get certificates from, like, say, for GoDaddy, for example.
And we'd go in there, you know, to our ESXi host and we'd install this wildcard certificate on a bunch of ESXi hosts.
And we'd have to go to every single one and install certificates.
And someone would spend a day or two installing certificates, you know, once a year or so.
vCenter doesn't accept a wildcard certificate.
So we'd have to get a certificate specifically for that vCenter name.
But now we don't have to really do any of all that.
We just need to get a Certificate Issuing Certificate for our vCMA and let it manage certificates in my vCenter environment for me.
So managing certificates in the vCenter client.
So, again, you want a trusted root certificate, right?
And we want to get an SSL certificate, right?
So we want a certificate for a Certificate Issuing Certificate from a trusted root CA.
We want SSL certificates so we can make sure our web services and things like that, when we connect to devices,
are re-entrusted.
Certificate Replacement and Renewal.
So certificates, if you get them from a third party, they're going to need to be renewed every year.
So every year you go in, they're going to get a new certificate.
You can get them for longer periods of time.
It's generally considered not a good practice to have them last for a really long time.
You want them for, you know, usually they issue them for two years, which means they're going to be good for a year.
And you're going to replace them at half their life every year.
You can also revoke them if you do get one for longer and for some reason all of a sudden
you think it's compromised, you can go to your trusted root CA and ask them to revoke your certificate.
Or you can go to your certificate management server and say to revoke that certificate for you also, right?
So a CSR is a certificate request.
So you can go in and, you know, look at these requests.
When a client's going to say, I need a certificate, it's just a request.
And the certificate authority is going to then approve that request and send you your certificate, all right?
And you can also review details on your certificate.
You can go in, if you see in your browser, you can click on it and say you want to view the certificate itself.
It'll tell you who issued it, the date it was issued on, the date it's going to expire, the date that the root certificate
expires, as well as the date that your certificate was issued to you is going to expire.
So hosts are provided certificates by the VCMA, right, by default.
So when you first install a host, it has a self-signed certificate.
When you join into vCenter, it gets a new certificate from the VCMA,
and that certificate is going to be trusted within your vSphere environment.
AutoDeploy also has its own certificate that it stores itself,
and this certificate is going to be a sub-certificate for the VCMA, right?
So, AutoDeploy also has its own managed certificate that it matches to, and it stores on its own storage.
So certificates require permission.
Certificate, in order to manage certificates, you can go into your advanced, I'm sorry,
go into your roles, and then go to your privileges, and certificate.manageCertificates
is going to be required by default.
You know, for example, you're going to be required to have a certificate.manageCertificates.
For example, your administrator at vSphere.local, it has all these permissions.
If you want to create a new specific user and role for managing certificates,
this is the privilege it's going to need to do that, right?
And the certificate is going to need the ESXi host name and IP address.
That's going to be in the certificate, so when you connect to the host and it sends you a certificate,
that certificate name is going to match what you have in your address bar.
So when you upgrade an ESXi host, if you've, you know, it's going to retain a certificate.
So whatever certificate it got from the VCMA, when you upgrade the host, it's going to keep
the same name and same IP address and all of that.
It's also going to keep that same certificate.
That is going to be retained through the upgrade process.
So uploading to a data store, it's really common if you don't have a certificate in your VCMA
that your client machine trusts, right?
So the VCMA and the ESXi host all trust it and that's why they can all talk to each other,
right?
But if you don't have a trusted certificate, what happens is you might go
to your vCenter environment and you can go to the data stores, go to a data store and say,
oh, I want to put an ISO on this data store.
So you click on upload, right?
You click the upload button and you browse to the ISO you want to upload.
And you say you want to upload it there and it fails.
Like right away it's going to fail because the certificates aren't trusted.
And that is very, very common unless you have trusted certificates by a trusted root CA.
So then what you have to do to work around that is download a tool like say, for example,
WinSCP, enable SSH on a host that has access to that data store and then WinSCP into that
host and then browse to the data store and use a tool like WinSCP to copy the ISO over that way.
So it works and it's a bunch more steps.
You need another tool, you need to enable SSH.
It's a bunch of steps.
But honestly, normally it's actually a lot faster to do it that way than to do it through
your browser.
So doing it through your browser, if you have all the right certificates and things,
it's fewer steps, it's easier, but it's usually pretty slow.
And doing it through a tool like WinSCP is a bunch more steps, but actually it usually
happens a lot faster.
So it's up to you which way you want to do it.
So just keep that in mind that you will have uploading to your data stores through your
browser if your vSphere client fails, if you don't have the trusted certificates.
So we discussed certificate manager and managing certificates with the vSphere client.