Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Generating Domain Root CA signed certificates for vCenter Server (1023688)

Last Updated: 10/19/2012Categories: How toTotal Views: 16434Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

Default vCenter Server / VirtualCenter Server SSL Certificate have expired

Environment uses an Internal Root Certificate Authority Server to sign new keys

Hardware Status, Search Function, Storage View, and Performance Overview do not work

In the vms.log file, located at C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Logs, you see the error:

I/O error: failed to decrypt safe contents entry: java.lang.ArithmeticException: / by zero

In the sms.log file, located at C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Logs, you see the error:

The session is not authenticated

Purpose

This article provides the information on how to generate SSL Cert Keys and sign it with an internal Root CA, so that all components on vCenter Server work properly.

Resolution

Requirements

You need to install Microsoft Visual C++ 2008 Redistributable Package (x86) before installing OpenSSL.

To download this package, see http://www.microsoft.com/downloads/en/confirmation.aspx?familyId=9b2da534-3e03-4391-8a4d-074b9f2bc1bf&displayLang=en.

You must also download and install Win32 OpenSSL v0.9.8r.

To download this package, see http://www.slproweb.com/products/Win32OpenSSL.html.

Notes:

Only use the version mentioned above, as this is currently the only supported version.

Ensure that Win32 OpenSSL is installed at c:\OpenSSL\bin\.

Ensure that the root CA certificate is added to the Trusted Roots for the Computer Account on each machine that is used to connect to the vCenter Server.

DNS is used for vCenter.

vCenter Server is part of the domain and the domain administrator has access to it.

You may need specify the environment variable for OpenSSL if running it from a different directory than the one specified here. For example, running the command set OPENSSL_CONF=<path>\openssl.conf specifies the path to the configuration file.

To generate SSL Cert Keys and sign it with an internal Root CA:

Create the folder C:\temp\vcenter\oldssl and back up the old SSL keys.

Create the folder C:\temp\vcenter\newssl to store the new SSL keys.

Verify that the private key exists in C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key.

Copy all the files in C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL to the temporary location C:\temp\vcenter\oldssl.

Run this command to generate the new RSA private key (2048 bit) and the certificate request:

Note: Ensure that the common name is the FQDN of the server.

c:\OpenSSL\bin\openssl.exe req -newkey rsa:2048 -keyout rui.key -nodes –days 3650 -out rui.csr

You see an output similar to:

Loading 'screen' into random state - done
Generating a 2048 bit RSA private key
.............................+++
......................................+++
writing new private key to 'rui.key'
-----
You are about to be asked to enter information that will be incorporated into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CA
State or Province Name (full name) [Some-State]:ONTARIO
Locality Name (eg, city) []:Toronto
Organization Name (eg, company) [Internet Widgits Pty Ltd]:VMware
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:vcenter.maximum.local
Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:

Note: Answer all the prompts in this output.

Run the dir command to list the directory:

C:\temp\vcenter\newssl>dir

You see an output similar to:

Volume in drive C has no label.
Volume Serial Number is 204A-99B1
Directory of C:\temp\vcenter\newssl
04/16/2010 03:50 PM <dir> .
04/16/2010 03:50 PM <dir> ..
04/16/2010 03:50 PM 1,024 .rnd
04/16/2010 03:49 PM 1,675 privkey.pem
04/16/2010 03:50 PM 1,679 rui.key
04/16/2010 03:50 PM 1,005 rui.cs

</dir></dir>

From vCenter Server, open a web browser and browse to the certsrv URL for your Active Directory Certificate Authority.

Select Request a certificate, Advanced certificate request, and then Submit a certificate using base-64.

Paste the entire contents of the CSR (open in Notepad) in the Saved Request box and click Web Server for Certificate template. The certificate gets signed.

In the next page, select Base 64 encoded then click Download certificate.

Save the certificate as rui.crt in c:\temp\vcenter\newssl.

Run this command to create the PFX fie from the private key and certificate:

c:\openssl\bin\openssl pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx

Open the rui.crt file in a text editor such as notepad.

Remove any data present before -----BEGIN CERTIFICATE-----.

Note: The above step is not mandatory for legacy versions of vCenter Server, however in vCenter Server 5.1 if there is a certificate with information before the -----BEGIN CERTIFICATE----- section Java may present the error: java.security.cert.CertificateParsingException: invalid DER-encoded certificate. Thus the registration of the service will fail. This has been known to occur with the vCenter Server upgrade failing with Error 26002. Unable to register vCenter Server to Inventory Service.

Stop the VMware VirtualCenter Management Webservices and VMware VirtualCenter Server services.

To stop these services:

Click Start > Run, type services.msc, and click OK. The Services window opens.

Right-click the service and click Stop.

Copy all the files in the newssl directory to: C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\, replacing the existing files in the directory.

Re-enter the DB password when prompted. For more information, see VirtualCenter Server Fails to Start After You Replace Default SSL Certificates with Custom SSL Certificates (1003070).

Restart the services in this order:

VMware VirtualCenter Server services

VMware VirtualCenter Management Webservices

Use a browser and navigate to the URL of vCenter Server. For example, https://vcenter.maximum.local.

Verify if the certificate is valid.

Note: After restarting the services, you must reconnect to the ESX/ESXi hosts and re-authenticate with root credentials on each server. This is because the SSL trust between the two has changed and a new trust relationship must to be established.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Windows 2003 虚拟机从物理转换为虚拟后 CPU 使用率过高 (1007172)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware VirtualCenter

VMware vCenter Server

Related Versions:

VMware VirtualCenter 2.5.x

VMware vCenter Server 5.1.x

VMware vCenter Server 5.0.x

VMware vCenter Server 4.1.x

VMware vCenter Server 4.0.x

Take Our Survey

Support Assistant