Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Replacing SSL certificates for VMware vCenter Update Manager by using the Update Manager Utility (1023011)

Last Updated: 6/8/2018Categories: How toTotal Views: 64544Language:
Chinese (Simplified)JapaneseEnglish

1 like this article

Subscribe to get an email
newsletter with new updates

1 people found this helpful Please provide article feedback:

Details

You can replace the default Update Manager SSL certificates with either self-signed certificates or certificates signed by a commercial certification authority (CA). This article provides information on replacing the SSL certificates in Update Manager 4.1 Update 1 and later.

The Update Manager 4.1 Update 1 and later releases include the Update Manager Utility that lets you replace the SSL certificates for Update Manager and perform other reconfiguration tasks. The Update Manager Utility is not available in earlier releases.

You can replace only the SSL certificates that Update Manager uses for communication between the Update Manager server and client components.

You cannot replace the SSL certificates that Update Manager uses on port 9087 when importing offline bundles or upgrade release files.

Certificate specifications

VMware products use standard X.509 version 3 (X.509v3) certificates. The default certificates must be replaced only with a signed certificate that conforms to Privacy Enhanced Mail (PEM), a key format that stores data in a Base-64 encoded Distinguished Encoding Rules (DER) format.

The key used to sign the certificates must be a standard RSA key with an encryption length ranging from 512 to 2048 bits. The recommended length is 2048 bits.

Certificate Location

Certificates are stored in the SSL folder located in the Update Manager installation directory.

The default path in 64-bit Windows is C:\Program Files (x86)\VMware\Infrastructure\Update Manager\SSL

The default path in 32-bit Windows is C:\Program Files\VMware\Infrastructure\Update Manager\SSL

Solution

Replacing the default certificates with Self-Signed Certificates

On the Update Manager Server, download and install OpenSSL 0.9.8.

Create a file named updatemanager.cfg, and include these configuration settings in the file:

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS: ServerShortName, DNS: ServerIPAddress, DNS: server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = VMwareUpdateManager
commonName = server.domain.com

Note: Modify all entries according to your environment specifications and ensure that you enter a commonName.

Open a command prompt and navigate to the openssl/bin folder.

To create the self-signed certificate (rui.key and rui.crt), run the command:

openssl req -x509 -sha256 -newkey rsa:2048 -keyout rui.key -extensions x509 -config updatemanager.cfg -out rui.crt -days 3650

To generate the .pfx file, run the command:

openssl pkcs12 -export -in rui.crt -inkey rui.key -name "rui" -passout pass:testpassword -out rui.pfx

On the Windows machine where Update Manager is installed, stop the VMware vCenter Update Manager service.

Backup and replace the certificates.

Copy rui.crt, rui.key, and rui.pfx from the machine where you generated the certificate files to the machine where Update Manager is installed.

Backup the files rui.crt, rui.key, and rui.pfx, located in the <Update_Manager_installation_directory>\SSL folder and replace the old rui.crt, rui.key, and rui.pfx with the files you created.

On the Windows machine where Update Manager is installed, import the certificates by using the Update Manager Utility:

Note: For more information about the procedure, see the Reconfiguration of VMware vCenter Update Manager Guide.

Navigate to the Update Manager installation directory and double-click VMwareUpdateManagerUtility.exeto start the Update Manager Utility.

Note: You may need to right-click VMwareUpdateManagerUtility.exeand Click Run as administrator.

Log in using the administrator credentials and the IP address or host name of vCenter Server system.

In the Options pane of the Update Manager Utility, Click SSL Certificate.

In the Configurations pane, select Followed and verified the steps, and Click Apply.

After the operation completes, start the VMware vCenter Update Manager service.

From the vSphere Client, install the new certificate in the Trusted root certificate authorities folder.

When you connect to the Update Manager server, a dialog with a security warning appears. In the Security Warning dialog, Click View Certificate.

In the Certificate window, Click Install Certificate. The Certificate Import Wizard appears.

Select the Place all certificates in the following store option and Click Browse. The Select Certificate Store window appears.

Navigate to Trusted root certificate authorities > Local Computer in the tree pane.

Select the Show physical stores option and Click OK.

In the Certificate Import Wizard, Click Next and then Click Finish. If the import is successful, you see a dialog with the message:

The import was successful

Click OK.

Replacing the default SSL Certificates with Certificates Signed by a Commercial CA

On the Update Manager Server, download and install download and install OpenSSL 0.9.8.

Create a file named updatemanager.cfg, and include these configuration settings in the file:

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS: ServerShortName, DNS: ServerIPAddress, DNS: server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = VMwareUpdateManager
commonName = server.domain.com

Note: Modify all entries according to your environment specifications and ensure that you enter a commonName.

Open a command prompt and navigate to the openssl/bin folder.

Create a certificate-signing request for Update Manager, run the command:

openssl req -new -nodes -out rui.csr -keyout rui-orig.key -config updatemanager.cfg

Convert the key to the proper RSA format for vSphere Update Manager, run the commnd:

openssl rsa -in rui-orig.key -out rui.key

Send the certificate request to a commercial certificate authority of your choice and wait for the return of the signed certificate.

After receiving the signed certificate from the commercial certificate authority, rename it to rui.crt.

Note: Because of a known issue in the JRE keytool.exe application, certificates must not contain any characters before the ---BEGIN CERTIFICATE---section or after the ---END CERTIFICATE---section of the certificate. If the certificate contains any characters in those places, use a text editor to delete the characters.

Create the PFX file .pfx file, run the command:

openssl pkcs12 -export -in rui.crt -inkey rui.key -name "rui" -passout pass:testpassword -out rui.pfx

On the Windows machine where Update Manager is installed, stop the VMware vCenter Update Manager service.

Backup the files rui.crt, rui.key, and rui.pfx, located in the <Update_Manager_installation_directory>\SSL folder and replace the old rui.crt, rui.key, and rui.pfx with the files you created.

On the Windows machine where Update Manager is installed, import the certificates using the Update Manager Utility. For more information about the procedure, see the Reconfiguration of VMware vCenter Update Manager Guide.

Navigate to the Update Manager installation directory and double-click VMwareUpdateManagerUtility.exeto start the Update Manager Utility.

Log in using the administrator credentials and the IP address or host name of vCenter Server system.

In the Options pane of the Update Manager Utility, Cick SSL Certificate.

In the Configurations pane, select Followed and verified the steps, and click Apply.

After the operation completes, start the VMware vCenter Update Manager service.

Note: For Update Manager 5.0, if the certificate for the Inventory Service is not modified, the Update Manager Utility cannot upgrade the certificate for Update Manager. In this case, you continue to see a default install certificate message when enabling the Update Manager plugin. For more information, see Configuring CA signed certificates for VMware vCenter Server 5.0.x (2015421).

Additional Information

For translated versions of this article, see:

日本語: Update Manager Utility を使用して VMware vCenter Update Manager の SSL 証明書を置き換える (2077065)

简体中文: 使用 Update Manager Utility 替换 VMware vCenter Update Manager 的 SSL 证书 (2078056)

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Update Manager

Related Versions:

VMware vCenter Update Manager 5.0.x

VMware vCenter Update Manager 4.1.x

Take Our Survey

Support Assistant