The security of the environment depends on the validity and trust of the management components certificates. If the certificates are approaching expiration, expired, compromised, or certificate attributes require changes, regenerate and replace the certificates.

Table 1. Design Decisions on Certificate Management for Intelligent Network Visibility

Decision ID

Design Decision

Design Justification

Design Implication

INV-VAON-SEC-011

Use a CA-Signed certificate containing the fully qualified domain names (FQDNs) of each VMware Aria Operations for Networks platform and collector node in the SAN attributes, when deploying VMware Aria Operations for Networks

Configuring a CA-Signed certificate ensures that the communication to the externally facing Web UI and API for VMware Aria Operations for Networks is encrypted.

  • Using CA-signed certificates from a certificate authority might increase the deployment preparation time as certificate requests are generated and delivered.

  • Each time a node is added the certificate must be replaced to include the fully qualified domain name of the additional node.

INV-VAON-SEC-012

Use a SHA-2 or higher algorithm when signing certificates.

The SHA-1 algorithm is considered less secure and has been deprecated.

Not all certificate authorities support SHA-2.

Update the NSX to VMware Aria Operations for Networks Integration for Intelligent Network Visibility for VMware Cloud Foundation

Before the certificate for the NSX principal identity expires, you regenerate and update the certificate. You then replace the certificate and private key and you refresh the credential in VMware Aria Operations for Networks.

Replace the NSX Principal Identity Certificate for Intelligent Network Visibility for VMware Cloud Foundation

Before the NSX Manager principal identity certificate expires, to continue using the NSX Manager principal identity, you regenerate the certificate and private key and you refresh the principal identity.

If you followed the Prepare the NSX to VMware Aria Operations for Networks Integration for Cloud-Based Network Visibili… procedure when implementing this validated solution, the NSX Manager principal identity certificate expires in 365 days. You use the contents of the certificate and the key file to refresh the principal identity in NSX Manager.

Note:

Some steps in this procedure require the use of the NSX API. To make this process easier, you use PowerShell cmdlets instead.

Procedure

  1. Log in to SDDC Manager at <sddc_manager_fqdn>:22 as the vcf user by using a Secure Shell (SSH) client.
  2. Switch to the super user.
    su
  3. Generate the certificate and private key.
    openssl req -newkey rsa:2048 -sha256 -x509 -days 365 -subj "/CN=nsx_local_manager_cluster_hostname" -extensions usr_cert -nodes -keyout nsx_local_manager_cluster_hostname.key -out nsx_local_manager_cluster_hostname.cer
    Note:

    You use the nsx_local_manager_cluster_hostname.key and nsx_local_manager_cluster_hostname.cer contents to refresh the principal identity in NSX Manager and refresh the credential in VMware Aria Operations for Networks.

  4. Import the new certificate in NSX Manager.
    1. Log in to NSX Manager at https://<nsx_manager_fqdn>/login.jsp?local=true as admin.
    2. On the main navigation bar, click System.
    3. In the left pane, navigate to Settings > Certificates.
    4. Click the Certificates tab and, from the Import drop-down menu, select Certificate.
    5. In the Import certificate dialog box, enter a certificate name identical to the service account name and turn off the Service certificate toggle switch.
    6. In the Certificate contents text box, paste the contents of the nsx_local_manager_cluster_hostname.cer certificate file.
    7. In the Private key text box, paste the contents of the nsx_local_manager_cluster_hostname.key file and click Save.
    8. Expand the newly created certificate and copy the ID.
  5. Update the principal identity with the new certificate by using PowerShell.

    1. Start PowerShell.

    2. Replace the values in the sample code and run the commands in the PowerShell console.
      $nsxManager = "sfo-m01-vc01.sfo.rainpole.io"
$nsxUser = "admin"
$nsxPass = "VMw@re1!VMw@re1!"

$principalIdentity = "svc-inv-sfo-m01-nsx"
$newCertificateId = "32fc1dd0-fabd-4643-b64e-35b708424538"
    3. Obtain the ID of the existing principal identity by running the command in the PowerShell console.
      $principalId = (Get-NsxtPrincipalIdentity -name $principalIdentity).id
    4. Update the principal identity's certificate by using the imported certificate's ID and the principal identity user ID.
      Set-NsxtPrincipalIdentityCertificate -principalId $principalId -certificateId $newCertificateId
  6. Remove the expired certificate from NSX Manager.
    1. Log in to NSX Local Manager for the management domain at https://<management_domain_nsx_local_manager_fqdn>/login.jsp?local=true as admin.
    2. On the main navigation bar, click System.
    3. In the left pane, navigate to Settings > Certificates.
    4. Locate the expired certificate, click the ellipsis and click Delete.
    5. In the Delete dialog box, click Delete.
  7. Repeat this procedure for each VI workload domain in the VMware Cloud Foundation instance.

Refresh the NSX to VMware Aria Operations for Networks Integration for Intelligent Network Visibility for VMware Cloud Foundation

After you update the NSX principal identity with the new certificate, you must refresh the credential in VMware Aria Operations for Networks and validate the data source connection.

Procedure

  1. Log in to VMware Aria Operations for Networks at https://<aria_operations_for_networks_fqdn> with a user assigned the Administrator role.
  2. In the left pane, navigate to Settings > Accounts and data sources.
  3. On the Data sources page, click the ellipses for the VMware NSX-T Manager and click Edit.
  4. On the Configuration page, in the Certificate text box, paste the contents of the nsx_local_manager_cluster_hostname.cer certificate file.
  5. In the Private key text box, paste the contents of the nsx_local_manager_cluster_hostname.key certificate file.
  6. Click Validate, verify that the new certificate is valid, and click Submit.
  7. In the Confirmation dialog box, select the confirmation check box and click Continue.
  8. Repeat the procedure for each VI workload domain NSX Manager in the VMware Cloud Foundation instance.