Skip to content

Jasons Blog

Insert intelligent and witty slogan here

Menu

Home

Blog

Tutorials

Gallery

Astro Gallery

Menu

vCenter/VCSA Cert checking

Posted on 13/03/202112/05/2021 by jase

If you look after a vCenter or VCSA at some point you are going to have the certificates expire on you. And if you look after a lot of vCenter servers then expiring Certs are a constant headache that pops up just at the time that is most inconvenient.
VMWare detail that only in some circumstances do Certs expire every 2 years but in my experience Certs will expire every time I am on-call.

Im not going to pretend to know much (anything) about vCenters certificates. In any production environment I normally end up logging a support case with VMWare.

Just about every vCenter I have ever worked with uses self signed certs, so that is what Im going to be looking at in this post. I am also assuming the PSC is imbedded as this is the best practice.
vCenter Certificates (for me) fall in to two categories. STS certificate and everything else.

Before making any changes make sure you have a backup and/or snapshot of the vCenter/PSC you are working on.

To check the vCenter Cert expiry dates you can do this in the following ways

SSH console

Web interface

SSH

log on to the vCenter server using SSH using the root account and type

shell

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo “[*] Store :” $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list –store $store –text | grep -ie “Alias” -ie “Not After”;done;

You will get a list of all the certs (not the STS cert) on the vCenter.
Check the expiry date to see if any have or are going to expire.

Web interface

Go to the Admin menu and select Administration

The vCenter admin menu

Then on the left select Certificate Management.

Certificates on the vCenter

To renew the certs you will need to run the
Certificate manager

Checking the STS Certificate

The STS (Security Token Service) is not listed above and when that expires nothing is going to work. It used be visible in the flash UI in the same place as all the other certs. But not anymore.
A useful KB is here that details determining if the STS cert has expired. If the vCenter has been rebooted then I do not get the error in the vpxd-svcs.log. The KB for renewing the cert is here

I go straight to downloading the Checksts.py script

I find the easy way is to simple SSH to the vCenter. open vi, paste in the contacts of the script and save it.

Shell
cd /tmp
vi checksts.py

Paste in the code and
type [Esc] then : then w! [enter]
type [Esc] then : then q [enter]
You can now run the script using

python checksts.py

if you get a syntax error then check the script as some times the first couple of lines to not get copyed in.

You will get a list of the 2 STS certs and there expiry date. If they need to be renewed keep reading.

Renewing STS certs

Please do not just blindly follow the below steps. Read the KB articles so you understand what you are doing.

There are certificate that expired or about to expire
Signing certificate is not valid

Again, I find the easy way is to simply SSH to the vCenter. open vi, paste in the contacts of the script and save it.

Shell
cd /tmp
vi fixsts.sh

Paste in the code and
type [Esc] then : then w! [enter]
type [Esc] then : then q [enter]
You now need to make the script executable and then it can be run.

chmod +x fixsts.sh
./fixsts.sh

Now you can restart services or reboot the vCenter

service-control –stop –all
service-control –start –all

I will list the scripts below for easy copy and pasting.

I hope this is of use.

checksts.pl

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

#!/opt/vmware/bin/python

"""

Copyright 2020-2022 VMware, Inc.  All rights reserved. -- VMware Confidential

Author:  Keenan Matheny ([email-masked])

"""

##### BEGIN IMPORTS #####

import os

import sys

import json

import subprocess

import re

import pprint

import ssl

from datetime import datetime, timedelta

import textwrap

from codecs import encode, decode

import subprocess

from time import sleep

try:

# Python 3 hack.

import urllib.request as urllib2

import urllib.parse as urlparse

except ImportError:

import urllib2

import urlparse

sys.path.append(os.environ['VMWARE_PYTHON_PATH'])

from cis.defaults import def_by_os

sys.path.append(os.path.join(os.environ['VMWARE_CIS_HOME'],

def_by_os('vmware-vmafd/lib64', 'vmafdd')))

import vmafd

from OpenSSL.crypto import (load_certificate, dump_privatekey, dump_certificate, X509, X509Name, PKey)

from OpenSSL.crypto import (TYPE_DSA, TYPE_RSA, FILETYPE_PEM, FILETYPE_ASN1 )

today = datetime.now()

today = today.strftime("%d-%m-%Y")

vcsa_kblink = "https://kb.vmware.com/s/article/76719"

win_kblink = "https://kb.vmware.com/s/article/79263"

##### END IMPORTS #####

class parseCert( object ):

# Certificate parsing

def format_subject_issuer(self, x509name):

items = []

for item in x509name.get_components():

items.append('%s=%s' %  (decode(item[0],'ascii'), decode(item[1],'ascii')))

return ", ".join(items)

def format_asn1_date(self, d):

return datetime.strptime(decode(d,'ascii'), '%Y%m%d%H%M%SZ').strftime("%Y-%m-%d %H:%M:%S GMT")

def merge_cert(self, extensions, certificate):

z = certificate.copy()

z.update(extensions)

return z

def __init__(self, certdata):

built_cert = certdata

self.x509 = load_certificate(FILETYPE_PEM, built_cert)

keytype = self.x509.get_pubkey().type()

keytype_list = {TYPE_RSA:'rsaEncryption', TYPE_DSA:'dsaEncryption', 408:'id-ecPublicKey'}

extension_list = ["extendedKeyUsage",

"keyUsage",

"subjectAltName",

"subjectKeyIdentifier",

"authorityKeyIdentifier"]

key_type_str = keytype_list[keytype] if keytype in keytype_list else 'other'

certificate = {}

extension = {}

for i in range(self.x509.get_extension_count()):

critical = 'critical' if self.x509.get_extension(i).get_critical() else ''

if decode(self.x509.get_extension(i).get_short_name(),'ascii') in extension_list:

extension[decode(self.x509.get_extension(i).get_short_name(),'ascii')] = self.x509.get_extension(i).__str__()

certificate = {'Thumbprint': decode(self.x509.digest('sha1'),'ascii'), 'Version': self.x509.get_version(),

'SignatureAlg' : decode(self.x509.get_signature_algorithm(),'ascii'), 'Issuer' :self.format_subject_issuer(self.x509.get_issuer()),

'Valid From' : self.format_asn1_date(self.x509.get_notBefore()), 'Valid Until' : self.format_asn1_date(self.x509.get_notAfter()),

'Subject' : self.format_subject_issuer(self.x509.get_subject())}

combined = self.merge_cert(extension,certificate)

cert_output = json.dumps(combined)

self.subjectAltName = combined.get('subjectAltName')

self.subject = combined.get('Subject')

self.validfrom = combined.get('Valid From')

self.validuntil = combined.get('Valid Until')

self.thumbprint = combined.get('Thumbprint')

self.subjectkey = combined.get('subjectKeyIdentifier')

self.authkey = combined.get('authorityKeyIdentifier')

self.combined = combined

class parseSts( object ):

def __init__(self):

self.processed = []

self.results = {}

self.results['expired'] = {}

self.results['expired']['root'] = []

self.results['expired']['leaf'] = []

self.results['valid'] = {}

self.results['valid']['root'] = []

self.results['valid']['leaf'] = []

def get_certs(self,force_refresh):

urllib2.getproxies = lambda: {}

vmafd_client = vmafd.client('localhost')

domain_name = vmafd_client.GetDomainName()

dc_name = vmafd_client.GetAffinitizedDC(domain_name, force_refresh)

if vmafd_client.GetPNID() == dc_name:

url = (

'http://localhost:7080/idm/tenant/%s/certificates?scope=TENANT'

% domain_name)

else:

url = (

'https://%s/idm/tenant/%s/certificates?scope=TENANT'

% (dc_name,domain_name))

return json.loads(urllib2.urlopen(url).read().decode('utf-8'))

def check_cert(self,certificate):

cert = parseCert(certificate)

certdetail = cert.combined

#  Attempt to identify what type of certificate it is

if cert.authkey:

cert_type = "leaf"

else:

cert_type = "root"

#  Try to only process a cert once

if cert.thumbprint not in self.processed:

# Date conversion

self.processed.append(cert.thumbprint)

exp = cert.validuntil.split()[0]

conv_exp = datetime.strptime(exp, '%Y-%m-%d')

exp = datetime.strftime(conv_exp, '%d-%m-%Y')

now = datetime.strptime(today, '%d-%m-%Y')

exp_date = datetime.strptime(exp, '%d-%m-%Y')

# Get number of days until it expires

diff = exp_date - now

certdetail['daysUntil'] = diff.days

# Sort expired certs into leafs and roots, put the rest in goodcerts.

if exp_date <= now:

self.results['expired'][cert_type].append(certdetail)

else:

self.results['valid'][cert_type].append(certdetail)

def execute(self):

json = self.get_certs(force_refresh=False)

for item in json:

for certificate in item['certificates']:

self.check_cert(certificate['encoded'])

return self.results

def main():

warning = False

warningmsg = '''

WARNING!

You have expired STS certificates.  Please follow the KB corresponding to your OS:

VCSA:  %s

Windows:  %s

''' % (vcsa_kblink, win_kblink)

parse_sts = parseSts()

results = parse_sts.execute()

valid_count = len(results['valid']['leaf']) + len(results['valid']['root'])

expired_count = len(results['expired']['leaf']) + len(results['expired']['root'])

#### Display Valid ####

print("\n%s VALID CERTS\n================" % valid_count)

print("\n\tLEAF CERTS:\n")

if len(results['valid']['leaf']) > 0:

for cert in results['valid']['leaf']:

print("\t[] Certificate %s will expire in %s days (%s years)." % (cert['Thumbprint'], cert['daysUntil'], round(cert['daysUntil']/365)))

else:

print("\tNone")

print("\n\tROOT CERTS:\n")

if len(results['valid']['root']) > 0:

for cert in results['valid']['root']:

print("\t[] Certificate %s will expire in %s days (%s years)." % (cert['Thumbprint'], cert['daysUntil'], round(cert['daysUntil']/365)))

else:

print("\tNone")

#### Display expired ####

print("\n%s EXPIRED CERTS\n================" % expired_count)

print("\n\tLEAF CERTS:\n")

if len(results['expired']['leaf']) > 0:

for cert in results['expired']['leaf']:

print("\t[] Certificate: %s expired on %s!" % (cert.get('Thumbprint'),cert.get('Valid Until')))

continue

else:

print("\tNone")

print("\n\tROOT CERTS:\n")

if len(results['expired']['root']) > 0:

for cert in results['expired']['root']:

print("\t[] Certificate: %s expired on %s!" % (cert.get('Thumbprint'),cert.get('Valid Until')))

continue

else:

print("\tNone")

if expired_count > 0:

print(warningmsg)

if __name__ == '__main__':

exit(main())

fixsts.sh

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

#!/bin/bash

# Run this from the affected PSC/VC

# Luciano Delorenzi [[email-masked]] - 1/2/2020

# NOTE: This works on external and embedded PSCs

# This script will do the following

# 1: Regenerate STS certificate

#

#

# What is needed?

# 1: Offline snapshots of VCs/PSCs

# 2: SSO Admin Password

NODETYPE=$(cat /etc/vmware/deployment.node.type)

if [ "$NODETYPE" = "management" ]; then

echo "Detected this node is a vCenter server with external PSC."

echo "Please run this script from a vCenter with embedded PSC, or an external PSC"

exit 0

fi

echo "NOTE: This works on external and embedded PSCs"

echo "This script will do the following"

echo "1: Regenerate STS certificate"

echo "What is needed?"

echo "1: Offline snapshots of VCs/PSCs"

echo "2: SSO Admin Password"

echo "IMPORTANT: This script should only be run on a single PSC per SSO domain"

mkdir -p /tmp/vmware-fixsts

SCRIPTPATH="/tmp/vmware-fixsts"

LOGFILE="$SCRIPTPATH/fix_sts_cert.log"

echo "==================================" | tee -a $LOGFILE

echo "Resetting STS certificate for $HOSTNAME started on $(date)" | tee -a $LOGFILE

echo ""| tee -a $LOGFILE

echo ""

DN=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmdir]' | grep dcAccountDN | awk '{$1=$2=$3="";print $0}'|tr -d '"'|sed -e 's/^[ \t]*//')

echo "Detected DN: $DN" | tee -a $LOGFILE

PNID=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep PNID | awk '{print $4}'|tr -d '"')

echo "Detected PNID: $PNID" | tee -a $LOGFILE

PSC=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep DCName | awk '{print $4}'|tr -d '"')

echo "Detected PSC: $PSC" | tee -a $LOGFILE

DOMAIN=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep DomainName | awk '{print $4}'|tr -d '"')

echo "Detected SSO domain name: $DOMAIN" | tee -a $LOGFILE

SITE=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep SiteName | awk '{print $4}'|tr -d '"')

MACHINEID=$(/usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost)

echo "Detected Machine ID: $MACHINEID" | tee -a $LOGFILE

IPADDRESS=$(ifconfig | grep eth0 -A1 | grep "inet addr" | awk -F ':' '{print $2}' | awk -F ' ' '{print $1}')

echo "Detected IP Address: $IPADDRESS" | tee -a $LOGFILE

DOMAINCN="dc=$(echo "$DOMAIN" | sed 's/\./,dc=/g')"

echo "Domain CN: $DOMAINCN"

ADMIN="cn=administrator,cn=users,$DOMAINCN"

USERNAME="administrator@${DOMAIN^^}"

ROOTCERTDATE=$(openssl x509  -in /var/lib/vmware/vmca/root.cer -text | grep "Not After" | awk -F ' ' '{print $7,$4,$5}')

TODAYSDATE=$(date | awk -F ' ' '{print $6,$2,$3}')

echo "#" > $SCRIPTPATH/certool.cfg

echo "# Template file for a CSR request" >> $SCRIPTPATH/certool.cfg

echo "#" >> certool.cfg

echo "# Country is needed and has to be 2 characters" >> $SCRIPTPATH/certool.cfg

echo "Country = DS" >> $SCRIPTPATH/certool.cfg

echo "Name = $PNID" >> $SCRIPTPATH/certool.cfg

echo "Organization = VMware" >> $SCRIPTPATH/certool.cfg

echo "OrgUnit = VMware" >> $SCRIPTPATH/certool.cfg

echo "State = VMware" >> $SCRIPTPATH/certool.cfg

echo "Locality = VMware" >> $SCRIPTPATH/certool.cfg

echo "IPAddress = $IPADDRESS" >> $SCRIPTPATH/certool.cfg

echo "Email = [email-masked]" >> $SCRIPTPATH/certool.cfg

echo "Hostname = $PNID" >> $SCRIPTPATH/certool.cfg

echo "==================================" | tee -a $LOGFILE

echo "==================================" | tee -a $LOGFILE

echo ""

echo "Detected Root's certificate expiration date: $ROOTCERTDATE" | tee -a $LOGFILE

echo "Detected today's date: $TODAYSDATE" | tee -a $LOGFILE

echo "==================================" | tee -a $LOGFILE

flag=0

if [[ $TODAYSDATE > $ROOTCERTDATE ]];

then

echo "IMPORTANT: Root certificate is expired, so it will be replaced" | tee -a $LOGFILE

flag=1

mkdir /certs && cd /certs

cp $SCRIPTPATH/certool.cfg /certs/vmca.cfg

/usr/lib/vmware-vmca/bin/certool --genselfcacert --outprivkey /certs/vmcacert.key  --outcert /certs/vmcacert.crt --config /certs/vmca.cfg

/usr/lib/vmware-vmca/bin/certool --rootca --cert /certs/vmcacert.crt --privkey /certs/vmcacert.key

fi

echo "#" > $SCRIPTPATH/certool.cfg

echo "# Template file for a CSR request" >> $SCRIPTPATH/certool.cfg

echo "#" >> $SCRIPTPATH/certool.cfg

echo "# Country is needed and has to be 2 characters" >> $SCRIPTPATH/certool.cfg

echo "Country = DS" >> $SCRIPTPATH/certool.cfg

echo "Name = STS" >> $SCRIPTPATH/certool.cfg

echo "Organization = VMware" >> $SCRIPTPATH/certool.cfg

echo "OrgUnit = VMware" >> $SCRIPTPATH/certool.cfg

echo "State = VMware" >> $SCRIPTPATH/certool.cfg

echo "Locality = VMware" >> $SCRIPTPATH/certool.cfg

echo "IPAddress = $IPADDRESS" >> $SCRIPTPATH/certool.cfg

echo "Email = [email-masked]" >> $SCRIPTPATH/certool.cfg

echo "Hostname = $PNID" >> $SCRIPTPATH/certool.cfg

echo ""

echo "Exporting and generating STS certificate" | tee -a $LOGFILE

echo ""

cd $SCRIPTPATH

/usr/lib/vmware-vmca/bin/certool --server localhost --genkey --privkey=sts.key --pubkey=sts.pub

/usr/lib/vmware-vmca/bin/certool --gencert --cert=sts.cer --privkey=sts.key --config=$SCRIPTPATH/certool.cfg

openssl x509 -outform der -in sts.cer -out sts.der

CERTS=$(csplit -f root /var/lib/vmware/vmca/root.cer '/-----BEGIN CERTIFICATE-----/' '{*}' | wc -l)

openssl pkcs8 -topk8 -inform pem -outform der -in sts.key -out sts.key.der -nocrypt

i=1

until [ $i -eq $CERTS ]

do

openssl x509 -outform der -in root0$i -out vmca0$i.der

((i++))

done

echo ""

echo ""

read -s -p "Enter password for administrator@$DOMAIN: " DOMAINPASSWORD

TENANTS=$(/opt/likewise/bin/ldapsearch -h localhost -p 389 -b "cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "(objectclass=vmwSTSTenantCredential)" | grep numEntries | awk '{print $3}')

echo ""

TRUSTEDCERTCHAINS=$(/opt/likewise/bin/ldapsearch -h localhost -p 389 -b "cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "(objectclass=vmwSTSTenantTrustedCertificateChain)" | grep numEntries | awk '{print $3}')

echo "Amount of tenant credentials: $TENANTS" | tee -a $LOGFILE

i=1

if [ ! -z $TENANTS ]

then

until [ $i -gt $TENANTS ]

do

echo "Exporting tenant $i to $SCRIPTPATH" | tee -a $LOGFILE

echo ""

ldapsearch -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" -b "cn=TenantCredential-$i,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" > $SCRIPTPATH/tenantcredential-$i.ldif

echo "Deleting tenant $i" | tee -a $LOGFILE

ldapdelete -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "cn=TenantCredential-$i,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" | tee -a $LOGFILE

((i++))

done

fi

echo ""

echo "Amount of trustedcertchains: $TRUSTEDCERTCHAINS" | tee -a $LOGFILE

i=1

if [ ! -z $TRUSTEDCERTCHAINS ]

then

until [ $i -gt $TRUSTEDCERTCHAINS ]

do

echo "Exporting trustedcertchain $i to $SCRIPTPATH" | tee -a $LOGFILE

ldapsearch -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" -b "cn=TrustedCertChain-$i,cn=TrustedCertificateChains,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" > $SCRIPTPATH/trustedcertchain-$i.ldif

echo ""

echo "Deleting trustedcertchain $i" | tee -a $LOGFILE

ldapdelete -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "cn=TrustedCertChain-$i,cn=TrustedCertificateChains,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" | tee -a $LOGFILE

((i++))

done

fi

echo ""

i=1

echo "dn: cn=TenantCredential-1,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" > sso-sts.ldif

echo "changetype: add" >> sso-sts.ldif

echo "objectClass: vmwSTSTenantCredential" >> sso-sts.ldif

echo "objectClass: top" >> sso-sts.ldif

echo "cn: TenantCredential-1" >> sso-sts.ldif

echo "userCertificate:< file:sts.der" >> sso-sts.ldif

until [ $i -eq $CERTS ]

do

echo "userCertificate:< file:vmca0$i.der" >> sso-sts.ldif

((i++))

done

echo "vmwSTSPrivateKey:< file:sts.key.der" >> sso-sts.ldif

echo "" >> sso-sts.ldif

echo "dn: cn=TrustedCertChain-1,cn=TrustedCertificateChains,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" >> sso-sts.ldif

echo "changetype: add" >> sso-sts.ldif

echo "objectClass: vmwSTSTenantTrustedCertificateChain" >> sso-sts.ldif

echo "objectClass: top" >> sso-sts.ldif

echo "cn: TrustedCertChain-1" >> sso-sts.ldif

echo "userCertificate:< file:sts.der" >> sso-sts.ldif

i=1

until [ $i -eq $CERTS ]

do

echo "userCertificate:< file:vmca0$i.der" >> sso-sts.ldif

((i++))

done

echo ""

echo "Applying newly generated STS certificate to SSO domain" | tee -a $LOGFILE

/opt/likewise/bin/ldapmodify -x -h localhost -p 389 -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" -f sso-sts.ldif | tee -a $LOGFILE

echo ""

echo "Replacement finished - Please restart services on all vCenters and PSCs in your SSO domain" | tee -a $LOGFILE

echo "==================================" | tee -a $LOGFILE

echo "IMPORTANT: In case you're using HLM (Hybrid Linked Mode) without a gateway, you would need to re-sync the certs from Cloud to On-Prem after following this procedure" | tee -a $LOGFILE

echo "==================================" | tee -a $LOGFILE

echo "==================================" | tee -a $LOGFILE

if [ $flag == 1 ]

then

echo "Since your Root certificate was expired and was replaced, you will need to replace your MachineSSL and Solution User certificates" | tee -a $LOGFILE

echo "You can do so following this KB: https://kb.vmware.com/s/article/2097936" | tee -a $LOGFILE

fi

2 thoughts on “vCenter/VCSA Cert checking”

Jim says:

26/06/2025 at 12:07 pm

Thank you for posting this.

Saved me in a pinch.

Reply

Matt says:

12/01/2026 at 8:03 pm

Just wanted to say thanks particularly at this time they had taken down the links for those two files, and needed them for my 6.5.

Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Save my name, email, and website in this browser for the next time I comment.

Δ

Search

Search for:

Blog categories

astronomical

Sidereal

Freenas

NetApp

OnTap

PowerShell

PowerCLi

Tutorial

Uncategorized

vCloud

VMWare

DR

fix

Reporting

Zerto

Tags

AFF
audit
Backup
build
Certificate
Config
data
datastore
disk
disks
Edge
Events
Expired
FAS
firewall
freenas
freenas core
function
Gateway
Host
Install
iscsi
jobs
NAT
NetApp
NSX
Password
ping
PowerCLi
Powershell
rename
report
Rules
search
Snapshots
SSH
STS
Tasks
tutorial
vCenter
vCloud Director
VCSA
VM
VMWare
vSphere

Recent Posts

Astronomical conversions

Converting local time to sidereal time

A quick shutdown / start VM script

NetApp disk model and firmware reporting

Get info out of the Zerto analytic portal

©2026 Jasons Blog

| WordPress Theme by Superbthemes.com

Menu

Home

Blog

Tutorials

Gallery

Astro Gallery