Need to replace the certificates with a custom certificate from a commercial or corporate Certificate Authority (CA)? You are going to need a Certificate Signing Request (CSR).
I use the certificate-manager tool (see below) included with vCenter to generate all of my requests. I found recently that you can skip this altogether if you can include the certificate’s key from the CA. In the traditional method, though, you will generate a CSR, submit to CA, and receive back a custom signed certificate.
/usr/lib/vmware-vmca/bin/certificate-manager
- Connect to your Platform Services Controller (PSC) via SSH. This could be the same as your vCenter server.
- Create a temporary directory to store your files in when you run the certificate-manager tool. Create a directory for each system you intend to generate CSR files for. I use the following format for my directory:
/tmp/hostname1
/tmp/hostname2
...
/tmp/hostnamen
- Run the certificate-manager tool:
/usr/lib/vmware-vmca/bin/certificate-manager
- Select option 1 to replace the Machine SSL.
- Provide the administrator username if the SSO domain is not default or press Enter.
- Provide the administrator password.
- Select option 1 to Generate Certificate Signing Request(s)…
- Provide an Output directory path such as
/tmp/hostname
The next information you will be requested to enter is for the certificate.
- Country – Use two digit code (https://www.iso.org/obp/ui/#search)
- Name – Use the fully qualified domain name of the server here
- Organization – Name of your organization
- OrgUnit – Name of your department
- State – The state where the system resides (no abbreviations)
- Locality – The city where the system resides
- IPAddress – IP address of the system
- Email – Email address for person or department responsible for administration of the system
- Hostname – It’s best to always include a fully qualified domain name as well as a short name.
- Proper value of VMCA ‘Name’ – I use the fully qualified domain name here
Press option 2 to Exit certificate-manager. Your csr and key files will be stored at the location you specified.
Apple Computer
If you use an Apple computer, you can use scp in the Terminal to copy the files.
$mkdir ~/Documents/Certificates/hostname/
$cd ~/Documents/Certificates/hostname/
$scp [email protected]:/tmp/hostname/*.* .
Windows Computer
If you use Windows, I recommend WinSCP. You will first need to set the shell on the Platform Services Controller to Bash.
chsh -s /bin/bash root
Follow the instructions of your CA on how to submit the CSR to be signed.
Leave a Reply