After you replace the machine SSL certificates, you can replace the solution user certificates.
Many VMware customers do not replace solution user certificates. They replace only the machine SSL certificates with custom certificates. This hybrid approach satisfies the requirements of their security teams.
- Certificates either sit behind a proxy, or they are custom certificates.
- No intermediate CAs are used.
You replace the machine solution user certificate and the solution user certificate on each vCenter Server system.
Note: When you list solution user certificates in large deployments, the output of
/usr/lib/vmware-vmafd/bin/dir-cli list includes all solution users from all nodes. Run
/usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost to find the local machine ID for each host. Each solution user name includes the machine ID.
Prerequisites
Each solution user certificate must have a different Subject. Consider, for example, including the solution user name (such as vpxd) or other unique identifier.
Procedure
Example: Replacing Solution User Certificates (Intermediate CA)
- Generate a public/private key pair for each solution user on each vCenter Server node in an Enhanced Linked Mode configuration. That includes a pair for the machine solution and a pair for each additional solution user (vpxd, vpxd-extension, vsphere-webclient, wcp).
- Generate a key pair for the machine solution user.
/usr/lib/vmware-vmca/bin/certool --genkey --privkey=machine-key.priv --pubkey=machine-key.pub
- Generate a key pair for the vpxd solution user on each node.
/usr/lib/vmware-vmca/bin/certool --genkey --privkey=vpxd-key.priv --pubkey=vpxd-key.pub
- Generate a key pair for the vpxd-extension solution user on each node.
/usr/lib/vmware-vmca/bin/certool --genkey --privkey=vpxd-extension-key.priv --pubkey=vpxd-extension-key.pub
- Generate a key pair for the vsphere-webclient solution user on each node.
/usr/lib/vmware-vmca/bin/certool --genkey --privkey=vsphere-webclient-key.priv --pubkey=vsphere-webclient-key.pub
- Generate a key pair for the wcp solution user on each node.
/usr/lib/vmware-vmca/bin/certool --genkey --privkey=wcp-key.priv --pubkey=wcp-key.pub
- Generate a key pair for the machine solution user.
- Generate solution user certificates that are signed by the new VMCA root certificate for the machine solution user and for each additional solution user (vpxd, vpxd-extension, vsphere-webclient, wcp) on each vCenter Server node.
Note: The --Name parameter has to be unique. Including the name of the solution user store name makes it easy to see which certificate maps to which solution user. The example includes the name, for example vpxd or vpxd-extension in each case.
- Make one copy of the /usr/lib/vmware-vmca/share/config/certool.cfg file, then modify or remove the Name, IP address, DNS name, and email fields as required, and rename the file, for example, to sol_usr.cfg.
- Generate a certificate for the machine solution user on each node.
/usr/lib/vmware-vmca/bin/certool --gencert --cert=new-machine.crt --privkey=machine-key.priv --Name=machine --config sol_usr.cfg
- Generate a certificate for the vpxd solution user on each node.
/usr/lib/vmware-vmca/bin/certool --gencert --cert=new-vpxd.crt --privkey=vpxd-key.priv --Name=vpxd --config sol_usr.cfg
- Generate a certificate for the vpxd-extensions solution user on each node.
/usr/lib/vmware-vmca/bin/certool --gencert --cert=new-vpxd-extension.crt --privkey=vpxd-extension-key.priv --Name=vpxd-extension --config sol_usr.cfg
- Generate a certificate for the vsphere-webclient solution user on each node by running the following command.
/usr/lib/vmware-vmca/bin/certool --gencert --cert=new-vsphere-webclient.crt --privkey=vsphere-webclient-key.priv --Name=vsphere-webclient --config sol_usr.cfg
- Generate a certificate for the wcp solution user on each node by running the following command.
/usr/lib/vmware-vmca/bin/certool --gencert --cert=new-wcp.crt --privkey=wcp-key.priv --Name=wcp --config sol_usr.cfg
- Replace the solution user certificates in VECS with the new solution user certificates.
Note: The --store and --alias parameters have to exactly match the default names for services.
- Replace the machine solution user certificate on each node:
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store machine --alias machine /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store machine --alias machine --cert new-machine.crt --key machine-key.priv
- Replace the vpxd solution user certificate on each node.
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store vpxd --alias vpxd /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store vpxd --alias vpxd --cert new-vpxd.crt --key vpxd-key.priv
- Replace the vpxd-extension solution user certificate on each node.
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store vpxd-extension --alias vpxd-extension /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store vpxd-extension --alias vpxd-extension --cert new-vpxd-extension.crt --key vpxd-extension-key.priv
- Replace the vsphere-webclient solution user certificate on each node.
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store vsphere-webclient --alias vsphere-webclient /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store vsphere-webclient --alias vsphere-webclient --cert new-vsphere-webclient.crt --key vsphere-webclient-key.priv
- Replace the wcp solution user certificate on each node.
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store wcp --alias wcp /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store wcp --alias wcp --cert new-wcp.crt --key wcp-key.priv
- Replace the machine solution user certificate on each node:
- Update VMware Directory Service (vmdir) with the new solution user certificates. You are prompted for a vCenter Single Sign-On administrator password.
- Run /usr/lib/vmware-vmafd/bin/dir-cli service list to get the unique service ID suffix for each solution user. You run this command on a vCenter Server system.
/usr/lib/vmware-vmafd/bin/dir-cli service list output: 1. machine-623bef28-0311-436e-b21f-6e0d39aa5179 2. vsphere-webclient-623bef28-0311-436e-b21f-6e0d39aa5179 3. vpxd-623bef28-0311-436e-b21f-6e0d39aa5179 4. vpxd-extension-623bef28-0311-436e-b21f-6e0d39aa5179 5. hvc-623bef28-0311-436e-b21f-6e0d39aa5179 6. wcp-1cbe0a40-e4ce-4378-b5e7-9460e2b8200e
Note: When you list solution user certificates in large deployments, the output of /usr/lib/vmware-vmafd/bin/dir-cli list includes all solution users from all nodes. Run /usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost to find the local machine ID for each host. Each solution user name includes the machine ID. - Replace the machine certificate in vmdir on each vCenter Server node. For example, if machine-6fd7f140-60a9-11e4-9e28-005056895a69 is the machine solution user on the vCenter Server, run this command:
/usr/lib/vmware-vmafd/bin/dir-cli service update --name machine-6fd7f140-60a9-11e4-9e28-005056895a69 --cert new-machine.crt
- Replace the vpxd solution user certificate in vmdir on each node. For example, if vpxd-6fd7f140-60a9-11e4-9e28-005056895a69 is the vpxd solution user ID, run this command:
/usr/lib/vmware-vmafd/bin/dir-cli service update --name vpxd-6fd7f140-60a9-11e4-9e28-005056895a69 --cert new-vpxd.crt
- Replace the vpxd-extension solution user certificate in vmdir on each node. For example, if vpxd-extension-6fd7f140-60a9-11e4-9e28-005056895a69 is the vpxd-extension solution user ID, run this command:
/usr/lib/vmware-vmafd/bin/dir-cli service update --name vpxd-extension-6fd7f140-60a9-11e4-9e28-005056895a69 --cert new-vpxd-extension.crt
- Replace the vsphere-webclient solution user certificate on each node. For example, if vsphere-webclient-6fd7f140-60a9-11e4-9e28-005056895a69 is the vsphere-webclient solution user ID, run this command:
/usr/lib/vmware-vmafd/bin/dir-cli service update --name vsphere-webclient-6fd7f140-60a9-11e4-9e28-005056895a69 --cert new-vsphere-webclient.crt
- Replace the wcp solution user certificate on each node. For example, if wcp-1cbe0a40-e4ce-4378-b5e7-9460e2b8200e is the wcp solution user ID, run this command:
/usr/lib/vmware-vmafd/bin/dir-cli service update --name wcp-1cbe0a40-e4ce-4378-b5e7-9460e2b8200e --cert new-wcp.crt
- Run /usr/lib/vmware-vmafd/bin/dir-cli service list to get the unique service ID suffix for each solution user. You run this command on a vCenter Server system.