The Story
Everyone loves a good story. Well today it begins with something I wanted to do for a while but haven’t got around to. I remember adjusting the certificates on 5.5 vCenter and it caused a lot of grief. Now it may have been my ignorance it also may have been due to poor documentation and guides, who knows. Now with VMware now going full linux (Photon OS) for the vCenter deployments (much more light weight) it’s still nice to see a green icon in your web browser when you navigate the nice new HTML5 based management interface. Funny that the guide I followed, even after applying their own certificate still had a “not secure” notification in their browser.
This might be because he didn’t install his Root CA certs into the computers trusted CA store on the machine he was navigating the web interface from. However I’m still going to thank RAJESH RADHAKRISHNAN for his post in VMArena. it helped. I will cover some alternatives however.
Not often I do this but I’m lazy and don’t feel like paraphrasing…
VCSA Certificate Overview
Before starting the procedure just a quick intro for managing vSphere Certificates, vSphere Certificates can manage in two different modes
VMCA Default Certificates
VMCA provides all the certificates for vCenter Server and ESXi hosts on the Virtual Infrastructure and it can manage the certificate lifecycle for vCenter Server and ESXi hosts. Using VMCA default the certificates is the simplest method and less overhead.
VMCA Default Certificates with External SSL Certificates (Hybrid Mode)
This method will replace the Platform Services Controller and vCenter Server Appliance SSL certificates, and allow VMCA to manage certificates for solution users and ESXi hosts. Also for high-security conscious deployments, you can replace the ESXi host SSL certificates as well. This method is Simple, VMCA manages the internal certificates and by using the method, you get the benefit of using your corporate-approved SSL certificates and these certificates trusted by your browsers.
Here we are discussing about the Hybrid mode, this the VMware’s recommended deployment model for certificates as it procures a good level of security. In this model only the Machine SSL certificate signed by the CA and replaced on the vCenter server and the solution user and ESXi host certificates are distributed by the VMCA.
I guess before I did the whole thing, were today I’m just going to be changing the cert that handles the web interface, which is all I really care about in this case.
Requirements
- Working PKI based on Active directory Certificate Server.
- Certificate Server should have a valid Template for vSphere environment
Note : He uses a custom template he creates. I simply use the Web Server template built in to ADCS. - vCenter Server Appliance with root Access
Requesting the Certificate
Now requesting the certificate requires shell access, I recommend to enable SSH for ease of copying data to and from the VCSA as well as commands.
To do this log into the physical Console of the VCSA, in my case it’s a VM so I opened up the console from the VCSA web interface. Press F2 to login.
Enable both SSH and BASH Shell
OK, now we can SSH into the host to make life easier (I used putty):
Run
/usr/lib/vmware-vmca/bin/certificate-manager
and select the operation option 1
Specify the following options:
- Output directory path: path where will be generated the private key and the request
- Country : your country in two letters
- Name : The FQDN of your vCSA
- Organization : an organization name
- OrgUnit : type the name of your unit
- State : country name
- Locality : your city
- IPAddess : provide the vCSA IP address
- Email : provide your E-mail address
- Hostname : the FQDN of your vCSA
- VMCA Name: the FQDN where is located your VMCA. Usually the vCSA FQDN
Once the private key and the request is generated select Option 2 to exit
Next we have to export the Request and key from the location.
There are several options on how to compete this. Option 1 is how our source did it…
Option 1 (WinSCP)
using WinSCP for this operation .
To perform export we need additional permission on VCSA , type the following command for same
chsh -s /bin/bash root
Once connected to vCSA from winscp tool navigate the path you have mentioned on the request and download the vmca_issued_csr.csr file.
Option 2 (cat)
Simple Cat the CSR file, and use the mouse to highlight the contents. Then paste it into ADCS Request textbox field.
Signing The Request
Now you simply Navigate to your signing certificate authorizes web interface. usually you hope that the PKI admin has secured this with TLS and is not just using http like our source, but instead uses HTTPS://FQDN/certsrv or just HTTPS://hostname/certsrv.
Now we want to request a certificate, an advanced certificated…
Now simply, submit and from the next page select the Base 64 encoded option and Download the Certificate and Certificate Chain.
Note :- You have to export the Chain certificate to .cer extension , by default it will be PKCS#7
Open Chain file by right click or double click navigate the certificate -> right click -> All Tasks -> export and save it as filename.cer
Now that we have our signed certificate and chains lets get to importing them back into the VCSA.
Importing the Certificates
Again there are two options here:
Option 1 (WinSCP)
using WinSCP for this operation .
To perform export we need additional permission on VCSA , type the following command for same
chsh -s /bin/bash root
Once connected to vCSA from winscp tool navigate the path you have mentioned on the request and upload the certnew.cer file. Along with any chain CA certs.
Option 2 (cat)
Simply open the CER file in notepad, and use the mouse to highlight the contents. Then paste it into any file on the VCSA over the putty session.
E.G
vim /tmp/certnew.cer
Press I for insert mode. Right click to paste. ESC to change modes, :wq to save.
Run
/usr/lib/vmware-vmca/bin/certificate-manager
and select the operation option 1
Enter administrator credentials and enter option number 2
Add the exported certificate and generated key path from previous steps and Press Y to confirm the change
Custom certificate for machine SSL: Path to the chain of certificate (srv.cer here)
Valid custom key for machine SSL: Path to the .key file generated earlier.
Signing certificate of the machine SSL certificate: Path to the certificate of the Root CA (root.cer , generated base64 encoded certificate).
Piss what did I miss…
That doesn’t mean shit to me.. “PC Load letter, wtf does that mean!?”
Googling, the answer was rather clear! Thanks Digicert!
Since I have an intermediate CA, and I was trying either the Intermediate or the offline it would fail.. I needed them both in one file. So opened each .cer and pasted them into one file “signedca.cer”
Now this did take a while, mostly around 70% and 85% but then it did complete!
Checking out the web interface…
Look at that green lock, seeing even IP listed in the SAN.. mhm does that mean…
Awwww yeah!!! even navigating the VCSA by IP and it still secure! Woop!
Conclusion
Changing the certificate in vCenter 6.7 is much more flexable and easier using the hybird approach and I say thumbs up. 😀 Thanks VMware.
Ohhh yea! Make sure you update your inventory hosts in your backup software with the new certificate else you may get error attempting backup and restore operations, as I did with Veeam. It was super easy to fix just validate the host under the inventory area, by going through the wizard for host configuration.