HOWTO: Replace a VMCA certificate via the GUI in vSphere 6.5 with PSC & VCSA

Published on 25 March 2017 by Christopher Lewis. Words: 344. Reading Time: 2 mins.

Introduction

In this blog post we will walkthrough how to use the GUI to replace the SSL certificates on both the vCenter Server Appliance (VCSA) and Platform Service Controller (PSC) in vSphere 6.5.

Step by Step Guide

Prerequisites

• A VMCA SSL Certificate (such as root_signing_cert.cer)
• A RSA Private Key (such as root_signing_cert.key)

Process Overview

The high level steps are as followed:

1. Log into the External Platform Services Controller.
   • Replace the Root Certificate.
2. Connect to the PSC Appliance.
   • Renew the Machine SSL Certificate.
   • Renew the Solution User Certificate.
3. Connect to the VCSA Appliance.
   • Renew the Machine SSL Certificate.
   • Renew the Solution User Certificate.
4. Reboot the Platform Services Controller.

Process Breakdown

Log into External Platform Services Controller

1. Navigate to https://psc-appliance.fqdn/psc.

2. Log in using the SSO Administrator account (e.g. administrator@vsphere.local) and password.

Renew the Root Certificate

1. Click Certificate Authority > Root Certificate.

2. Click Replace Certificate.

3. Click Browse and locate the Private Key file and click Open.
4. Click Browse and locate the VMCA Certificate file and click Open.

5. Click OK.

Connect to the Platform Services Controller

1. Click Certificate Management.

2. Type the SSO Administrator password and click Submit.

Renew the Machine SSL Certificate

3. Click the Machine Certificates tab.

4. Select the __MACHINE_CERT and click Renew.

5. Click Yes.

Renew the Solution User Certificates

1. Click the Solution User Certificates tab.

2. Click Renew All.

3. Click Yes.

4. Click Logout.

Connect to the vCenter Server

1. Type the vcenter.fqdn into the Server IP/FQDN text box and then enter the password for the SSO Administrator.

2. Click Submit.

Renew the Machine SSL Certificate

1. Click the Machine Certificates tab.

2. Select the __MACHINE_CERT and click Renew.

3. Click Yes.

Renew the Solution User Certificates

1. Click the Solution User Certificates tab.

2. Click Renew All.

3. Click Yes.

4. Click Logout.

Reboot the Platform Services Controller

1. Click Appliance Settings.

2. Click the VMware Platform Services Appliance link.

3. Enter username as root and the root password, then click Logon.

4. Click Reboot.

5. Click Yes.

There we have it, your VCSA should now be acting as a Subordinate CA using the VMCA solution!

Published on 25 March 2017 by Christopher Lewis. Words: 344. Reading Time: 2 mins.

Share this article on: