Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Generating custom or default SSL certificates (1029944)

Last Updated: 3/20/2024Categories: How toTotal Views: 77716Language:
Chinese (Simplified)JapaneseEnglish

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

In the sms.log file, you may notice these errors:

at java.lang.Thread.run(Thread.java:619)
Thread-2 ERROR com.vmware.vim.common.lifecycle.InitializerExecutor] Initialization error; attempt 2 will begin in 60 seconds...
java.util.concurrent.ExecutionException: java.lang.IllegalStateException: com.vmware.vim.common.vdb.VdbException: Error decrypting password
at java.util.concurrent.FutureTask$Sync.innerGet(FutureTask.java:222)
at java.util.concurrent.FutureTask.get(FutureTask.java:83)
at com.vmware.vim.common.lifecycle.InitializerExecutor$MonitorCallback.run(Unknown Source)
at java.lang.Thread.run(Thread.java:619)
Caused by: java.lang.IllegalStateException: com.vmware.vim.common.vdb.VdbException: Error decrypting password
at com.vmware.vim.common.lifecycle.InitializerExecutor$MonitorCallback$1.run(Unknown Source)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.r

Or

SEVERE: Error starting endpoint
java.io.IOException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded
at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1277)
at java.security.KeyStore.load(KeyStore.java:1185)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:344)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:263)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:473)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:413)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:129)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:503)
at org.apache.tomcat.util.net.JIoEndpoint.start(JIoEndpoint.java:526)
at org.ap

Or

SEVERE: Catalina.start:
LifecycleException: service.getName(): "Catalina"; Protocol handler start failed: java.io.IOException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded
at org.apache.catalina.connector.Connector.start(Connector.java:1138)
at org.apache.catalina.core.StandardService.start(StandardService.java:531)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Jun 9, 2011 1:49:45 PM org.apache.

Purpose

This article provides steps to generate default or custom SSL certificates.

You may need to generate default or custom SSL certificates if:

You experience the symptoms in Issues viewing Storage Views, Performance Overview, and Hardware Status when OpenSSL 1.0.0 version or higher is used to create self-signed certificates (1025966).

Your certificates have expired and you need to regenerate new certificates.

Caution: This article is specifically for vSphere 4.x .

If you are using vSphere 5.0, see Implementing CA signed SSL certificates with vSphere 5.0 (2015383).

If you are using vSphere 5.1, see Implementing CA signed SSL certificates with vSphere 5.1 (2034833).

Resolution

Caution: Ensure that lockdown mode is disabled before replacing vCenter Server Certificates. You need to connect to the host as root for re-adding it into vCenter Server. For more information, see Enabling or disabling Lockdown mode on an ESXi host (1008077) .

Installing OpenSSL

To install OpenSSL:

Download and install 0.9.8y version of OpenSSL for Win32 or Win64 (depending on if the operating system is 32-bit or 64-bit). Keep the default location during install.

Note: Some CA servers only accept 2048-bit keys. In this case, replace both instances of 1024 below with 2048.

If prompted, download and install Microsoft Visual C++ 2008 Redistributable Package, click here for Windows 32bit OS or here for Windows 64bit OS .

Note: The preceding links were correct as of October 8, 2014. If you find the links are broken, please provide feedback and a VMware employee will update the link.

Edit openssl.cfg file in openssl\bin:

under [ CA_Default ]: dir = .

under [ req ] change: default_bits = 1024

under [ req ] change: default_keyfile = rui.key

Generating a default certificate

To generate a default certificate:

Open the OpenSSl application using a command prompt:

cd c:\openssl\bin

Note: Ensure to Run as administrator when opening the command prompt.

To generate the rui.key file, run the command:

openssl genrsa 1024 > rui.key

To generate the rui.crt file, run the command:

openssl.exe req -new -x509 -days 3650 -sha1 -nodes -key rui.key -out rui.crt -config openssl.cfg

Note: After running the openssl.exe req -new command you are asked to enter this information

country code (for example, US)

state (for example, New Jersey)

city (press Enter to leave blank or enter a city name)

OU (press Enter to leave blank or enter an OU),

Common name (for example, FQDN of vCenter Server )

Note: It may be necessary to issue the Certificate as 'vmware' for the common name, as VDI and other 3rd party tools vCenter Server could require this.

email (press Enter to leave blank).

4. To generate the rui.pfx file, run the command:

openssl.exe pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx

Generating a custom certificate

To generate a custom CA signed certificate:

Open the OpenSSl application using a command prompt:

cd c:\openssl\bin

Note: Ensure to Run as administrator when opening the command prompt.

To generate the rui.key file, run the command:

openssl genrsa 1024 > rui.key

To create the rui.csr file, run the command:

openssl req -new -nodes -out rui.csr -config openssl.cfg

You see an output similar to:

Generating a #### bit RSA private key
...........................++++++..........++++++writing new private key to 'rui.key'-----

You are asked to enter information that are

incorporated into your certificate request.
You need to enter a Distinguished Name or a DN.
The blank fields can be ignored and there are default value for some field which needs to be left as is
If you enter '.', the field is left blank.

Country Name (2 letter code) [AU]: - E nter 2 letter country (example: US)
State or Province Name (full name) [Some-State]: - enter your state (example: California, or enter to leave blank)
Locality Name (eg, city) []: -Enter your city (example: San Diego, or enter to leave blank)
Organization Name (eg, company) [Internet Widgits Pty Ltd] :(ie. Company Name Inc.)
Organizational Unit Name (eg, section) []: (i.e. OU)
Common Name (eg, YOUR name) []: ***MUST BE FQDN OF VCENTER*** (ie. vcenter.domain.local)
Email Address []: (i.e. [email-masked] , or enter to leave blank)
An optional company name []: (enter to leave blank unless you require one)
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []: (enter to leave blank unless you require one)

Open the rui.csr file with a text editor and copy entire contents including beginning and ending tags.

Open users Web interface for users CA server and generate certificate request, pasting the block of text as the certificate request.

The certificate now needs to be signed by authorized user.

After receiving the certificate from the authorized signer, rename it to rui.crt and generate a .pfx file:

openssl.exe pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx

Open the rui.crt file in a text editor such as notepad.

Remove any data present before -----BEGIN CERTIFICATE----- .

Note: The above step is not mandatory for legacy versions of vCenter Server, however in vCenter Server 5.1 if there is a certificate with information before the -----BEGIN CERTIFICATE----- section Java may present the error:

java.security.cert.CertificateParsingException: invalid DER-encoded certificate.

Thus the registration of the service fails. This is known to occur with the vCenter Server Upgrade failing with Error 26002. Unable to register vCenter Server to Inventory Service.

Applying the generated certificates

To apply the certificates:

Set DRS to manual on each cluster. This prevents mass migrations after reconnecting the hosts to vCenter Server in step 8.

Stop the VMware VirtualCenter Server service. For more information, see Stopping, starting, or restarting vCenter services (1003895) .

Create a backup of this folder:

C:\(Documents and Settings)ProgramData\(AllUsers)\(Application Data)\VMware\VMware VirtualCenter\SSL

Note: Folders in parenthesis are for Windows Server 2003.

Replace rui.crt, rui.key, rui.pfx files in this folder with the new files.

Open a command prompt and run this command:

c:\Program Files\VMware\Infrastructure\VirtualCenter Server\ vpxd.exe -p

When prompted, enter the ODBC password twice.

Start the VMware VirtualCenter Server service. For more information, see Stopping, starting, or restarting vCenter services (1003895) .

Manually reconnect each host to vCenter server (right-click the host and choose Connect).

Note: If you see an error asking for your credentials, enter the root credentials for the host.

Related Information

For related information, see Regenerating expired SSL certificates after 2 years (1009092).

The procedure for replacing SSL certificates in vCenter Server 4.1 has changed. For more information, see Replacing vCenter Server 4.1 and 5.0 SSL certificates using the vpxd -p command fails with the error: failed to do early initialization (1030661).

How to stop, start, or restart vCenter Server services
Enabling or disabling Lockdown mode on an ESXi host
Regenerating expired SSL certificates after 2 years in VMware vCenter Server 4.x / 5.0.x
Issues viewing Storage Views, Performance Overview, and Hardware Status when OpenSSL 1.0.0 version or higher is used to create self-signed certificates
Replacing vCenter Server 4.1 and 5.0 SSL certificates using the vpxd -p command fails with the error: failed to do early initialization
Pairing VRMS server with vCenter Server fails with the error: Unacceptable signature algorithm: MD5withRSA
Implementing CA signed SSL certificates with vSphere 5.0
Implementing CA signed SSL certificates with vSphere 5.x
カスタムまたはデフォルトの SSL 証明書を生成する
生成自定义或默认 SSL 证书

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

KB
•
VMware Tools によってインストールされた ThinPrint モジュールを削除する (1013363)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Server

Related Versions:

VMware vCenter Server 4.1.x

VMware vCenter Server 4.0.x

Take Our Survey

Support Assistant