Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

VMware Cloud Foundation components certificates replacement (56496)

Last Updated: 1/28/2020Categories: How toTotal Views: 6718Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Purpose

You can replace the certificates for the following externally accessible VMware Cloud Foundation components.

SDDC Manager

vCenter Server

Platform Services Controllers

NSX Manager

vRealize Log Insight

vRealize Operations

Resolution

It is recommended that you replace all components right after deploying Cloud Foundation. After you create workload domains, you can replace certificates for the appropriate components.

Prerequisites

You must have a Windows host with PowerShell installed on it.

For a Microsoft Windows signed certificate, the Windows host must be in the same domain as the Windows CA.

The account that you use to log in must have administrative privileges. Although non-administrator users can download and launch the tool, all operations fail if you do not have the proper permissions.

You must have created a Microsoft CA template. See Microsoft Certificate Authority Template in VMware Validated Design for Software-Designed Data Center.

You must have downloaded and installed OpenSSL for Windows. You can obtain the binary file from here. It can be extracted anywhere in the Windows path.

Create the Configuration File Package for the Certificate Generation Tool

Create a configuration file that contains certificate information for your organization. Using this configuration file, the tool generates a file package that contains a configuration file for the VMs in each Cloud Foundation component.

You can specify the components for which you want to replace certificates in the configuration file. It is recommended that you replace all certificates immediately after you deploy Cloud Foundation. Subsequently, you can replace certificates for a subset of components, as appropriate.

Note: For information on creating a configuration file, please see the "Example Configuration File for Certificate Replacement After Deployment" in the VMware Cloud Foundation Admin Guide.

To create the configuration file package:

Using the root credentials, SSH in to the SDDC Manager Controller VM.

If you have not already done so, copy the configuration file to a directory on the SDDC Manager Controller VM, for example; /tmp/cert-config.json.

Navigate to /opt/vmware/cert-mgmt/bin.

Run the following command:

./vcfcerthelper  --config_file config.json  --cert_dir cert-output  --action build-certgen-config

The file package for the Certificate Generation Tool is created in the specified directory. The tool also creates a zip file of the directory contents in the parent directory.

Generate Key Pairs and Certificates

With the Certificate Generation utility, you can either create certificates signed by Microsoft Windows, or create a certificate signing request for a third-party CA.

Note: There is a known security risk when copying key pairs and certificates to the /root/certs directory because it is not FIPS compliant.

Use a file transfer utility to copy the file package zip file from the SDDC Manager Controller VM to the Windows host.

Extract the contents of the zip file on the Windows host. The CertGenVVD-*.ps1 file is included in the extracted files.

Navigate to the directory where you extracted the contents of the zip file.

Run one of the following commands in PowerShell:

To create a Microsoft Windows signed certificate, run the following command:

CertGenVVD-3.0.ps1 -MSCASigned -attrib 'CertificateTemplate:VMware' -inter

To create a certificate signing request for a third-party CA, run the following command.

CertGenVVD-3.0.1.ps1 -CSR

Type a password for the key file. A folder named SignedByMSCACerts is created.

Zip the contents of the SignedByMSCACerts folder.

Use a file transfer utility to copy the SignedByMSCACerts zipped folder to the SDDC Manager Controller VM in the /opt/vmware/cert-mgmt/bin directory.

Navigate to the /opt/vmware/cert-mgmt/bin directory and unzip the SignedByMSCACerts folder.

Build the File Package for Certificate Replacement Tool

Package the generated key pairs, CA-signed certificates, and CA chain to prepare them for the certificate replacement tool.

Note: If the key files are password protected, you must have the password. All password-protected key files must have the same password.

Please follow these step to build the file package:

Using the root credentials, SSH in to the SDDC Manager Controller VM.

In the /opt/vmware/cert-mgmt/bin directory of the SDDC Manager Controller VM, type the following command.

./vcfcerthelper --config_file config.json --cert_dir SignedByMSCACerts --password 'psswd' --action build-certrepl-config --enable_ssl_passthrough

The file package is created in the same directory that contains the CA signed certificates.

Backup TrustStores

Complete the following to backup the TrustStores for vCenter Server, Platform Services Controllers, and SDDC Manager Controller VM.

In the /opt/vmware/cert-mgmt/bin directory of the SDDC Manager Controller VM, type the following command.

./vcfcerthelper --action list-ca --cert_dir truststore-backup-day-1

Take Snapshots of Cloud Foundation Components

Take a snapshot of Cloud Foundation components, the certificate configuration tool has a built-in feature to create these snapshots.

In the /opt/vmware/cert-mgmt/bin directory of the SDDC Manager Controller VM, type the following command.

./vcfcerthelper --config_file config.json --action create-snapshot

Replace Certificates

Note: This requires that the certificate have a valid date of at least 24 hours prior.

After the snapshots have been taken, replace the certificates with the signed certificates you generated.

Navigate to the /opt/vmware/cert-mgmt/bin directory of the SDDC Manager Controller VM.

Run the following command.

/usr/java/jre-vmware/bin/java -Djsse.enableSNIExtension=false -jar /opt/vmware/cert-mgmt/lib/certreplace-0.0.1-SNAPSHOT.jar -config SignedByMSCACerts/config-vcf.json

Verify that the System Works with the New Certificates

​Note: If there are any VDI workload domains in the environment, see ​the "Re-trust VDI Workload Domains" section in the VMware Cloud Foundation Admin Guide.
Access the SDDC Manager Dashboard to verify that the new certificates work.

In a web browser, login to the SDDC Manager Dashboard to verify that it displays correctly: https://IP-FQDN:8443/vrm-ui.

Launch vCenter Server Web Client to verify that it displays correctly.

If vRealize Operations is deployed, login to vRealize Operations and verify that all adapters are collecting data. Some adapters may display an error until the next collection cycle.

Verify Trust for Replaced Certificates

If you replaced certificates for specific components, you must verify trust. To do so:

SSH in to the SDDC Manager Controller VM.

Navigate to the /opt/vmware/cert-mgmt/bin/vcfcerthelper directory.

Type the following command:

./vcfcerthelper --action verify-trust --cert_dir dir

Delete Snapshots of Cloud Foundation Components

After certificates have been replaced successfully, delete the snapshots.
Note: Only delete the Cloud Foundation snapshots after certificates have been successfully replaced.

In the /opt/vmware/cert-mgmt/bin/vcfcerthelper directory of the SDDC Manager Controller VM, type the following command.

./vcfcerthelper --config_file config.json --action remove-snapshot

Related Information

VMware Cloud Foundation Admin Guide.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Cloud Foundation

Related Versions:

VMware Cloud Foundation 2.x

Take Our Survey

Support Assistant