Generating vCenter Solution User Certificates With Custom Names
Many enterprises require replacing all vCenter certificates with Enterprise CA trusted certificates.
vSphere 6.5 has made the certificate updating process so much easier than the complication of the vSphere 5.x days.
Basic vCenter now has a single Machine SSL certificate as well as four Solution user certificates: machine (different from machine SSL), vpxd, vpxd-extension, vsphere-webclient.
Although the Solution user certificates are only used for internal vCenter communication, many enterprise security standards require using enterprise CA issues certificates for everything.
BTW, when you migrate from a Windows vCenter 5.5 to VCSA 6.5 using the excellent migration tool, only the Machine SSL certificate is taken across, the Solution user certificates remain self-signed and may need to be manually updated.
Each Solution user certificate needs to have a unique name.
Also remember, the SubjectAltName must contain DNS Name=machine_FQDN
I used the great guide from Ian Sanderson for updating the certs as a base https://www.snurf.co.uk/vmware/replace-ssl-certificates-on-vmware-psc-v6-5/
You can use the VMware supplied vSphere Certificate Manager in the VCSA (sidebar, you should really be using the VCSA rather than Windows by now!) to generate the solutions user certificate.
/usr/lib/vmware-vmca/bin/certificate-manager
When you select Option 5 and then Option 1 to generate the certificate private keys and certificate signing requests to send off to your Enterprise CA, the tool has a particular format for the signing requests.
Recent Comments