After you replace the Platform Services Controller certificate, you replace the vCenter Server machine SSL certificate.

About this task

You replace the certificates of the Platform Services Controller nodes during their deployment. You replace vCenter Server certificates after you deploy all virtual infrastructure components.

You replace certificates twice, once for each vCenter Server instance. You can start replacing certificates on Management vCenter Server sfo01m01vc01.sfo01.rainpole.local first.

Table 1. Certificate-Related Files on the vCenter Server Instances

vCenter Server FQDN

Files for Certificate Replacement

Replacement Order

sfo01m01vc01.sfo01.rainpole.local

  • sfo01m01vc01.key

  • sfo01m01vc01.1.cer

  • Root64.cer

First

sfo01w01vc01.sfo01.rainpole.local

  • sfo01w01vc01.key

  • sfo01w01vc01.1.cer

  • Root64.cer

Second

Prerequisites

  • CA-signed certificate files generated by using VMware Validated Design Certificate Generation Utility (CertGenVVD). See the VMware Validated Design Planning and Preparation documentation.

  • A Windows host with an SSH terminal access software such as PuTTY and an scp software such as WinSCP installed.

Procedure

  1. Change the vCenter Server appliance command shell to the Bash shell to allow secure copy (scp) connections.
    1. Open an SSH connection to sfo01m01vc01.sfo01.rainpole.local.
    2. Log in using the following credentials.

      Setting

      Value

      User name

      root

      Password

      vcenter_server_root_password

    3. Run the following commands to enable Bash shell access for the root user.
      shell
      chsh -s "/bin/bash" root
  2. Copy the generated certificates to the vCenter Server Appliance.
    1. Run the following command to create a new temporary folder.
      mkdir -p /root/certs
    2. Copy the certificate files sfo01m01vc01.1.cer, sfo01m01vc01.key and Root64.cer to the /root/certs folder.

      You can use an scp software such as WinSCP.

  3. Replace the CA-signed certificate on the vCenter Server instance.
    1. Start the vSphere Certificate Manager utility on the vCenter Server instance.
      /usr/lib/vmware-vmca/bin/certificate-manager
    2. Select Option 1 (Replace Machine SSL certificate with Custom Certificate), enter the default vCenter Single Sign-On user name administrator@vsphere.local and the vsphere_admin_password password.
    3. When prompted for the Infrastructure Server IP, enter the IP address of the Platform Services Controller that manages this vCenter Server instance.

      Option

      IP Address of Connected Platform Services Controller

      sfo01m01vc01.sfo01.rainpole.local

      172.16.11.61

      sfo01w01vc01.sfo01.rainpole.local

      172.16.11.63

    4. Select Option 2 (Import custom certificate(s) and key(s) to replace existing Machine SSL certificate).
    5. When prompted, provide the full path to the custom certificate, the root certificate file, and the key file that you copied over earlier, and confirm the import with Yes (Y).

      vCenter Server

      Input to the vSphere Certificate Manager Utility

      sfo01m01vc01.sfo01.rainpole.local

      Please provide valid custom certificate for Machine SSL.

      File : /root/certs/sfo01m01vc01.1.cer

      Please provide valid custom key for Machine SSL.

      File : /root/certs/sfo01m01vc01.key

      Please provide the signing certificate of the Machine SSL certificate.

      File : /root/certs/chainRoot64.cer

      sfo01w01vc01.sfo01.rainpole.local

      Please provide valid custom certificate for Machine SSL.

      File : /root/certs/sfo01w01vc01.1.cer

      Please provide valid custom key for Machine SSL.

      File : /root/certs/sfo01w01vc01.key

      Please provide the signing certificate of the Machine SSL certificate.

      File : /root/certs/chainRoot64.cer 

  4. After Status shows 100% Completed, wait several minutes until all vCenter Server services are restarted.
  5. Run the following commands to restart the vami-lighttp service and to remove certificate files.
    service vami-lighttp restart
    cd /root/certs/
    rm sfo01m01vc01.1.cer sfo01m01vc01.key Root64.cer
  6. After you replace the certificate on the Management vCenter Server sfo01m01vc01.sfo01.rainpole.local, repeat the procedure to replace the certificate on the Compute vCenter Server sfo01w01vc01.sfo01.rainpole.local.