Replace a vCenter Server STS Certificate Using the Command Line

You can replace the vCenter Server STS certificate with a custom generated or third-party certificate using the CLI.

To use a company required certificate or to refresh a certificate that is near expiration, you can replace the existing STS signing certificate. To replace the default STS signing certificate, you must first generate a new certificate.

The STS certificate is not an external-facing certificate. Do not replace this certificate unless the security policy of your company requires it.

Caution: You must use the procedures described here. Do not replace the certificate directly in the file system.

Prerequisites

Enable SSH login to vCenter Server. See Manage vCenter Server from the vCenter Server Shell.

Procedure

1. Log in to the vCenter Server shell as root.
2. Create a certificate.
   1. Create a top-level directory to hold the new certificate and verify the location of the directory.

      mkdir newsts
      cd newsts
      pwd 
      #resulting output: /root/newsts

   2. Copy the certool.cfg file into the new directory.

      cp /usr/lib/vmware-vmca/share/config/certool.cfg /root/newsts
      

   3. Using a command-line editor such as Vim, open your copy of the certool.cfg file and edit it to use the local vCenter Server IP address and hostname. The country is required and has to be two characters, as shown in the following example.

      #
      # Template file for a CSR request
      #
      
      # Country is needed and has to be 2 characters
      Country = US
      Name = STS
      Organization = ExampleInc
      OrgUnit = ExampleInc Dev
      State = Indiana
      Locality = Indianapolis
      IPAddress = 10.0.1.32
      Email = [email protected]
      Hostname = homecenter.exampleinc.local

   4. Generate the key.

      /usr/lib/vmware-vmca/bin/certool --server localhost --genkey --privkey=/root/newsts/sts.key --pubkey=/root/newsts/sts.pub
      

   5. Generate the certificate.

      /usr/lib/vmware-vmca/bin/certool --gencert --cert=/root/newsts/newsts.cer --privkey=/root/newsts/sts.key --config=/root/newsts/certool.cfg
      

   6. Create a PEM file with the certificate chain and private key.

      cat newsts.cer /var/lib/vmware/vmca/root.cer sts.key > newsts.pem

3. Update the STS signing certificate, for example:

   /opt/vmware/bin/sso-config.sh -set_signing_cert -t vsphere.local /root/newsts/newsts.pem

4. Restart the vCenter Server system, and any other vCenter Server system that is part of an Enhanced Linked Mode configuration. See the topic about how to reboot vCenter Server in the vCenter Server Configuration documentation.
   For authentication to work correctly, you must restart vCenter Server. Both the STS service and the vSphere Client are restarted.