Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Certificate Generation Utility for VMware Validated Design for Software-Defined Data Center 6.x (78246)

Last Updated: 4/21/2021Categories: InformationalTotal Views: 9727Language:
English

3 like this article

Subscribe to get an email
newsletter with new updates

3 people found this helpful Please provide article feedback:

Symptoms

Your VMware SDDC environment requires custom SSL certificates that must be signed by a trusted CA, you can use the CertGenVVD tool to generate a Certificate Signing Request (CSR) and have it signed.

Purpose

About Certificate Generation Utility for VMware Validated Designs

The Certificate Generation Utility for VMware Validated Designs (CertGenVVD) is a PowerShell script that you can use to generate custom certificates for the products that you use to build a Software-Defined Data Center (SDDC) based on VMware Validated Design for Software-Defined Data Center. Use the utility to reduce the number of steps for end-to-end certificate replacement.

CertGenVVD is written in PowerShell. It operates according to the settings in a configuration file and generates custom SSL certificates that can be signed by the following enterprise certificate authorities (CAs):

Microsoft Certificate Authority

For information about certificate replacement during SDDC deployment, see VMware Validated Design Architecture and Design and VMware Validated Design Planning and Preparation from the VMware Validated Designs Documentation.

What's new in the CertGenVVD utility?

Version 6.0 of the CertGenVVD utility provides the following new features:

Support for generating certificates required for the Solution documentation in VMware Validated Design 6.x

Supported platforms

The CertGenVVD utility requires a Windows operating system with the following installed.

Platform Component

Required Version

Operating system

Windows Server 2012 R2, 2016 or 2019

OpenSSL

1.0.2q or later

Visual C++ Redistributable Packages

2013

OpenSSL Notes

CertGenVVD requires an OpenSSL binary for Windows, which can be compiled from OpenSSL.org. Additionally, the OpenSSL Wiki page (https://wiki.openssl.org/index.php/Binaries) has a list of pre-compiled windows binaries compiled by the 3rd parties. Read all security disclosures and disclaimers when using binaries compiled by 3rd parties. The recommended 3rd party binary is Win64 OpenSSL v1.0.2q Light since this does not include the unnecessary OpenSSL source code.

Before executing CertGenVVD, ensure that the path for the OpenSSL binary for Windows is set in the PATH environment variable and that the Microsoft Visual C++ Redistributable Packages for Visual Studio 2013 is installed.

Compatibility

This CertGenVVD utility is compatible with, and referenced in the documentation for specific versions of VMware Validated Design for Software-Defined Data Center & VMware Cloud Foundation.

Product Version

VMware Validated Design for Software-Defined Data Center 6.x

VMware Cloud Foundation 4.x

VMware Cloud Foundation 3.10

Utility File Structure

The CertGenVVD utility consists of a PowerShell script and configuration files that you can update according to the requirements of your environment.

File or Folder

Description

CertgenVVD-6.0.version.ps1

This PowerShell script generate certificates.

RegionA-Hosts.csv

Configuration CSV to match a VMware Validated Design Region A. These can be used as a sample for your environment.

RegionB-Hosts.csv

Configuration CSV to match a VMware Validated Design Region B. These can be used as a sample for your environment.

Resolution

Prerequisites

To run the CertGenVVD utility, you must meet specific requirements on the Windows system on which you run the utility.

Verify that the account that you use to log in has administrative privileges.

Although non-administrator users can download and launch the tool, operations may fail if you do not have the correct permissions.

Configure the PowerShell execution policy with the permissions required to run the commands.

Run the Execute Get-ExecutionPolicycommand to get the active execution policy.

If the Execute Get-ExecutionPolicycommand returns Restricted, run the Set-ExecutionPolicy RemoteSigned command.

Create a Microsoft Certificate Authority template, called VMware, that you use to generate the certificates for the SDDC management components. See

https://docs.vmware.com/en/VMware-Validated-Design/6.0/sddc-deployment-of-the-management-domain-in-the-first-region/GUID-8C4CA6F7-CEE8-45C9-83B4-09DD3EC5FFB0.html for template creation instructions.

Obtain the CertGenVVD utility

Download the CertGenVVD tool.

Copy the tool to a Windows virtual machine that has access to the infrastructure.

Extract the .zip to any folder and preserve the folder structure.

Use the CertGenVVD utility with VMware Validated Design

To use the CertGenVVD tool with versions 6.0 of VMware Validated Design, from the Attachments section download the version-specific .zip that contains the configuration files for the version, and then extract and replace the content to a local directory.

Create Configuration Files

Edit the csv files included in the attached bundle to match your environment. The column descriptions are:

Column

Description

Name

Description of each row. This will not be used in the configuration file and should not be altered.

CommonName

FQDN of the common name to be used in the cert. For load balanced components this should be the FQDN of the load balancer VIP. For single node components this should be the FQDN of the node.

SAN*

FQDNs of additional node to be added as SAN attributes in addition to the Common Name. For load balanced components this would be the FQDN of each node.

Use the CertGenVVD utility to generate CA-signed certificates from an online Microsoft CA

Note: You must run CertGenVVD from a machine that is a member of the Microsoft Windows domain tha certificate authority is on.

Open a Windows PowerShell prompt as an administrator and navigate to the directory where you extracted the attached .zip.

Run the PowerShell script to launch the menu.

.\CertGenVVD-6.0.ps1

Select Option 1 to generate all config files, Certificate Signing Requests (CSRs) and certificates from an online Microsoft Root CA.

When prompted, select the path to the relevant csv file containing the hostnames for which you require certificates.

When prompted, enter the password to be used to encrypt the PKCS#12 certificates.

The certificates are signed by a Microsoft CA according to the requirements of the validated design.

The generated certificates are saved to the certgenvvd_home_dir\SignedByMSCACertsfolder in multiple formats according to the certificate requirements of the SDDC management components, that is, in X.509, PEM, PKCS#12 and PKCS#7.

The CertGenVVD utility configures the certificate chain files with the password that you specified during the generation.

Use the CertGenVVD utility to create certificates that are signed by an intermediate certificate authority

CertGenVVD supports intermediate Microsoft certificate authorities and does not need access to the root certificate authority. CertGenVVD concatenates the certificates of all of the certificate authorities into the certificate chain.

Run the PowerShell script to launch the menu.

.\CertGenVVD-6.0.ps1

Select Option 2 to generate all config files, Certificate Signing Requests (CSRs) and certificates from an online Microsoft Intermediate CA.

When prompted, select the path to the relevant csv file containing the hostnames for which you require certificates.

When prompted, enter the intermediate CA path.

Note: Inspect the intermediate CA certificate and look for the "Issued By" value. Full path will be "Issuing-CA-FQDN\Issued-By-Value."

Use the CertGenVVD utility to create certificate requests (CSRs) to request certificates from an offline or third-party CA

Run the PowerShell script to launch the menu..

.\CertGenVVD-6.0.ps1

Select Option 3 to generate all required CSR files for manual certificate requests from an offline or 3rd party CA

When prompted, select the path to the relevant csv file containing the hostnames for which you require certificates.

Locate the CSR files in the certgenvvd_home_dir\CSR folder and send it to the third-party CA to get signed certificates.The CA will send you signed .cer files for each CSR and the Root certificate.

Rename the CA root certificate to Root64.cer.

If there are multiple intermediate CAs, concatenate the certificates into one certificate chain file.

copy IntermediateCAroot01.cer+IntermediateCAroot02.cer+RootCA.cer > Root64.cer

Place the signed certificates in the corresponding certgenvvd_home_dir\ <product>directories, and the Root64.cerin certgenvvd_home_dir \Root64.

To create the required certificate formats run the CertGenVVD utility again.

.\CertGenVVD-6.0.ps1

Select Option 4 to generate all required certificate formats.

Additional command options that are not related to certificate generation for VMware Validated Designs

Additional options available

Option

Command

View help

h

Validate the readiness of the machine on which you plan to run the CertGenVVD utility

v

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

CertGen-6.2.003

Additional Resources

KB
•
VMware vSphere Platinum、VMware Cloud Foundation Platinum、および VMware vCloud Suite Platinum エディションの提供終了について (77536)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Cloud Foundation

Related Versions:

VMware Validated Design for Software-Defined Data Center (SDDC)

VMware Cloud Foundation 4.x

VMware Cloud Foundation 3.10.x

Take Our Survey

Support Assistant