This topic describes how you can rotate configurable leaf certificates for your VMware Tanzu Operations Manager deployment. To rotate all certificates in your Tanzu Operations Manager deployment, see Rotating CAs and Leaf Certificates.

You can generate configurable certificates and paste them into Tanzu Operations Manager configuration panes where ever needed. Examples include certificates that stop SSL traffic into VMware Tanzu Application Service for VMs (TAS for VMs), or authenticate a Single Sign-On for VMware Tanzu service plan to an external SAML server.

To rotate SAML certificates for both TAS for VMs and the Single Sign-On for VMware Tanzu service, see Rotating identity provider SAML certificates.

This procedure does not rotate the Tanzu Operations Manager root certificate authority (CA) or other CAs in your deployment. To rotate CAs and leaf certificates, see Rotating CAs and Leaf Certificates.

Prerequisites

Before you rotate certificates:

  • You must have Tanzu Operations Manager v3.0.

  • You must have Jammy stemcells at version 1.8 or later, Xenial stemcells at version 621.171 or later, and be running Windows 2019.41 or later.

    If you have any VMs deployed with any of the following stemcells, you will have to recreate the VMs at every Apply Changes step:
    • Xenial stemcells earlier than release 621.171
    • Windows stemcells earlier than release 2019.41
    • Jammy stemcells earlier than release 1.8
    If you are still using these stemcell versions and you cannot immediately upgrade, you must enable the Recreate all service instances errand, if the service tile provides it.
    Running this errand pushes BOSH Agent certificate updates to service instances.

    If the service tile does not include the Recreate all service instances errand, see the procedure Running with old Xenial or Windows stemcells on Rotating CAs and leaf certificates using the Tanzu Operations Manager API for instructions.

  • You must reset any certificates that were manually set in CredHub on Tanzu Operations Manager v2.6 and earlier to prevent them from being rotated with other certificates generated by CredHub. To find and reset any manually set certificates in CredHub, see Reviewing manually set certificates in CredHub.

If you use VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), rotate your certificates using the instructions in the TKGI documentation. For certificates that are not rotated by the TKGI procedures, see Advanced certificate rotation with CredHub Maestro.

  • Your product tile must have one of the following versions installed to rotate CredHub-managed certificates with the Tanzu Operations Manager API:

    • TAS for VMs v2.7.21 or later.
    • TAS for VMs v2.8.2 or later.
    • Isolation Segment tile v2.7.21 or later.
    • Isolation Segment tile v2.8.2 or later.
    • Small Footprint TAS for VMs v2.7.21 or later.
    • Small Footprint TAS for VMs v2.8.2 or later.
    • TAS for VMs [Windows] v2.7.17 or later.
    • TAS for VMs [Windows] v2.8.2 or later.

If you have an earlier version of a product tile that was previously listed, use this procedure to rotate certificates managed only by Tanzu Operations Manager. Then, to rotate certificates managed in CredHub, see Advanced certificate rotation with CredHub Maestro.

Procedure

You can set a value to override the duration for certificates in the BOSH Director tile. VMware recommends that you set the value before starting a certificate rotation. For more information, see Overriding duration for certificates.

To rotate configurable leaf certificates:

  1. Go to Tanzu Operations Manager Installation Dashboard.

  2. For each certificate you want to rotate:

    1. Find the text box where the leaf certificate is configured in the Tanzu Operations Manager UI. You might need to look through multiple configuration panes to identify the location of the certificate configuration text field, and in some cases, the tile might not expose the field in the UI. In that case the value must be updated using the Tanzu Operations Manager API. Use the following fields to identify the location of the certificate configuration text field:
      • The product_guid text box in the Tanzu Operations Manager API output can help identify the tile in which the certificate is configured. For example, the prefix p-bosh- refers to the BOSH Director tile, and the prefix cf- refers to the TAS for VMs tile.
      • The property_reference text box in the Tanzu Operations Manager API output can help identify the configuration pane in which the certificate is configured. For example, the uaa.service_provider_key_credentials property is configured in the UAA pane of the TAS for VMs tile.
    2. Copy a new value for the leaf certificate into the text field or generate a new leaf certificate using the Generate RSA Certificate button.
    3. Click Save for each new leaf certificates value you add.

  3. Return to Tanzu Operations Manager Installation Dashboard.

  4. Click Review Pending Changes.

  5. Click Apply Changes.

Certificates with specialized procedures

Some certificates are not rotated when using the standard rotation procedure. The following table lists certificates that use separate, specialized rotation procedures and provides links to documentation and Knowledge Base articles to help you rotate these certificates.

Certificate Tile Procedure
.properties.saml_service_provider_cert BOSH Director How to check and rotate Tanzu Operations Manager SAML Certificate before it expires
.uaa.service_provider_key_credentials TAS for VMs Rotating Identity Provider SAML Certificates

Troubleshooting

The Tanzu Operations Manager API runs CredHub Maestro when rotating certificates. If a certificate rotation API command is unsafe, CredHub Maestro stops the command and returns one or more safety violations.

For example, CredHub Maestro stops a certificate rotation API command if you try to follow certificate rotation steps in the wrong order. Because performing these steps in the wrong order can make your deployment unstable or cause downtime, CredHub Maestro stops the command and returns an error message.

For information about how to troubleshoot safety violation errors that are returned when rotating certificates, see Troubleshooting CredHub Maestro safety violations during certificate rotation.

check-circle-line exclamation-circle-line close-line
Scroll to top icon