Certificate Replacement. 26 SEP 2017 VMware Validated Design 4.1 VMware Validated Design for Management and Workload Consolidation 4.

Transcription

1 Certifite Replement 26 SEP 2017 VMwre Vlidted Design 4.1 VMwre Vlidted Design for Mngement nd Worklod Consolidtion 4.1

2 Certifite Replement You n find the most up-to-dte tehnil doumenttion on the VMwre wesite t: If you hve omments out this doumenttion, sumit your feedk to dofeedk@vmwre.om VMwre, In Hillview Ave. Plo Alto, CA Copyright 2017 VMwre, In. All rights reserved. Copyright nd trdemrk informtion. VMwre, In. 2

3 Contents Aout VMwre Vlidted Design Certifite Replement for Consolidted SDDC 4 1 Crete nd Add Mirosoft Certifite Authority Templte for Consolidted SDDC 5 2 Generte MSCA-Signed Certifites for the SDDC Mngement Components 7 3 Generte Certifite Signing Requests nd Certifites from Third-Prty CA for Consolidted SDDC 10 4 Reple the Certifites of the Mngement Produts for Consolidted SDDC 14 Reple Certifites of the Virtul Infrstruture Components for Consolidted SDDC 15 Reple the Pltform Servies Controller Certifite for Consolidted SDDC 16 Reple the vcenter Server Certifite for Consolidted SDDC 19 Reple the ESXi Host Certifites in Consolidted SDDC 25 Reple the NSX Mnger Certifites for Consolidted SDDC 31 Reple Certifite on vsphere Dt Protetion for Consolidted SDDC 33 Reple Certifites of the Cloud Mngement Pltform Components for Consolidted SDDC 34 Reple the vrelize Automtion Certifite in Consolidted SDDC 35 Updte the vrelize Automtion Certifite on vrelize Business for Consolidted SDDC 39 Updte the vrelize Automtion Certifite on vrelize Opertions Mnger for Consolidted SDDC 39 Reple the SSL Certifite of vrelize Business Server for Consolidted SDDC 40 Reple Certifites of the Opertions Mngement Components for Consolidted SDDC 41 Reple vrelize Opertions Mnger Certifite for Consolidted SDDC 42 Reple the Certifite of vrelize Log Insight for Consolidted SDDC 43 VMwre, In. 3

4 Aout VMwre Vlidted Design Certifite Replement for Consolidted SDDC VMwre Vlidted Design Certifite Replement provides step-y-step instrutions out repling ertifites on ll mngement omponents of running Softwre-Defined Dt Center (SDDC) whose design follows this VMwre Vlidted Design for Mngement nd Worklod Consolidtion. In Consolidted SDDC, the seurity of the environment depends on the vlidity nd trust of the mngement ertifites. As est prtie, you reple mngement ertifites in the following ses: Before ertifites expire When ertifite is ompromised. When the ttriutes relted to ertifite hnge, for exmple, the host nme or orgniztion nme. The ertifite replement proess onsists of the following phses: 1 Otin ertifites for the mngement omponents tht re signed y ustom ertifite uthority (CA). Use the VMwre Vlidted Design Certifite Genertion utility to utomtilly generte the ertifites for ll omponents. Mnully generte Certifite Signing Requests (CSRs) nd request CA-signed ertifites providing the CSRs to the CA. 2 Reple the ertifites in the live SDDC environment. Intended Audiene The VMwre Vlidted Design Certifite Replement doumenttion is intended for loud rhitets, infrstruture dministrtors, loud dministrtors nd loud opertors who re fmilir with nd wnt to use VMwre softwre to deploy in short time nd mnge Consolidted SDDC tht meets the requirements for pity, slility, kup nd restore, nd disster reovery. Required Softwre VMwre Vlidted Design Certifite Replement is omplint nd vlidted with ertin produt versions. See VMwre Vlidted Design Relese Notes for more informtion out supported produt versions. VMwre, In. 4

5 Crete nd Add Mirosoft Certifite Authority Templte for Consolidted SDDC 1 You rete Mirosoft Certifite Authority Templte to ontin the ertifite uthority (CA) ttriutes for signing ertifites for the mngement produts in the Consolidted SDDC. This VMwre Vlidted Design sets the CA up on oth Ative Diretory (AD) servers: the min domin d01rpl.rinpole.lol (root CA) nd the sudomin d01sfo.sfo01.rinpole.lol (the intermedite CA). Creting ertifite uthority templte for this VMwre Vlidted Design inludes the following opertions: 1 Set up Mirosoft Certifite Authority templte. 2 Add the new templte to the ertifite templtes of the Mirosoft CA. Prerequisites Verify tht you instlled Mirosoft Server 2012 R2 VMs with Ative Diretory Domin Servies enled. Verify tht the Certifite Authority Servie role nd the Certifite Authority We Enrolment role is instlled nd onfigured on oth Ative Diretory Server. Verify tht d01sfo.sfo01.rinpole.lol hs een set up to e the intermedite CA of the root CA d01rpl.rinpole.lol. Use hshing lgorithm of SHA-2 or higher on the ertifite uthority. 1 Log in to the following AD server y using Remote Desktop Protool (RDP) lient. Vlue FQDN If you use the intermedite CA, onnet to d01sfo.sfo01.rinpole.lol. If you use only the root CA, onnet d01rpl.rinpole.lol. User nme Pssword Ative Diretory dministrtor d_dmin_pssword 2 Clik Windows Strt > Run, enter erttmpl.ms, nd lik OK. 3 In the Certifite Templte Console, under Templte Disply Nme, right-lik We Server nd lik Duplite Templte. VMwre, In. 5

6 Certifite Replement 4 In the Duplite Templte window, leve Windows Server 2003 Enterprise seleted for kwrd omptiility nd lik OK. 5 In the Properties of New Templte dilog ox, lik the Generl t. 6 In the Templte disply nme text ox, enter VMwre s the nme of the new templte. 7 Clik the Extensions t nd speify extensions informtion: d e f Selet Applition Poliies nd lik Edit. Selet Server Authentition, lik Remove, nd lik OK. Selet Key Usge nd lik Edit. Selet the Signture is proof of origin (nonrepudition) hek ox. Leve the defult for ll other options. Clik OK. 8 Clik the Sujet Nme t, ensure tht the Supply in the request option is seleted, nd lik OK to sve the templte. 9 To dd the new templte to your CA, lik Windows Strt > Run, enter ertsrv.ms, nd lik OK. 10 In the Certifition Authority window, expnd the left pne if it is ollpsed. 11 Right-lik Certifite Templtes nd selet New > Certifite Templte to Issue. 12 In the Enle Certifite Templtes dilog ox, selet the VMwre ertifite tht you just reted in the Nme olumn nd lik OK. VMwre, In. 6

7 Generte MSCA-Signed Certifites for the SDDC Mngement Components 2 Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte with single opertion ertifites tht re signed y the Mirosoft ertifite uthority (MSCA) for ll mngement omponents. In this wy, you n skip sending Certifite Signing Requests to third-prty CA. The generted ertifites re omplint with the requirements of the individul mngement omponents. For informtion out the VMwre Vlidted Design Certifite Genertion Utility, see VMwre Knowledge Bse rtile nd the VMwre Vlidted Design Plnning nd Preprtion. Prerequisites Provide Window Server 2012 host tht is prt of the sfo01.rinpole.lol domin. Instll n intermedite CA server on the sfo01.rinpole.lol 1 Log in to the Windows host tht hs ess to your dt enter. 2 Downlod the CertGenVVD-version.zip file of the Certifite Genertion Utility from VMwre Knowledge Bse rtile on the Windows host where you onnet to the dt enter nd extrt the ZIP file to the C: drive. 3 In the C:\CertGenVVD-version folder, open the defult.txt file in text editor. 4 Verify tht following properties re onfigured. ORG=Rinpole In. OU=Rinpole.lol LOC=SFO ST=CA CC=US CN=VMwre_VVD keysize=2048 VMwre, In. 7

8 Certifite Replement 5 Verify tht only the C:\CertGenVVD-version\ConfigFiles folder ontins only following files. Tle 2 1. Certifite Genertion Files for Consolidted SDDC SDDC Lyer Host Nme or Servie in Consolidted SDDC Configurtion Files Virtul Infrstruture Pltform Servies Controller sfo01w01ps01.sfo01.ri npole.lol sfo01w01ps01.txt vcenter Server ESXi Hosts NSX Mnger sfo01w01v01.sfo01.rin pole.lol sfo01w01esx01.sfo01.ri npole.lol sfo01w01esx02.sfo01.rinp ole.lol sfo01w01esx03.sfo01.rinp ole.lol sfo01w01esx04.sfo01.rinp ole.lol sfo01w01nsx01.sfo01.ri npole.lol sfo01w01v01.txt sfo01w01esx01.txt sfo01w01esx02.txt sfo01w01esx03.txt sfo01w01esx04.txt sfo01w01nsx01.txt Business Continuity vsphere Dt Protetion sfo01w01vdp01.sfo01.ri npole.lol sfo01m01vdp01.txt Cloud Mngement Pltform vrelize Automtion vr01svr01.rinpole.l ol vr01svr01.rinpole. lol vr01iws01.rinpole.l ol vr01iws01.rinpole. lol vr01ims01.rinpole.l ol vr01ims01.rinpole.lol vr-for-1-pod.txt vrelize Business Server vr01svr01.rinpole.lol vr.txt Opertions Mngement vrelize Opertions Mnger vrops01svr01.rinpol e.lol vrops01svr01.rinpo le.lol vrelize Log Insight sfo01vrli01.sfo01.rin pole.lol sfo01vrli01.sfo01.ri npole.lol vrops-for-1-pod.txt vrli-for-1-pod.txt 6 Verify tht eh onfigurtion file inludes FQDNs nd host nmes in the dedited setions. For exmple, the onfigurtion files for the Pltform Servie Controller instnes must ontin the following properties: VMwre, In. 8

9 Certifite Replement sfo01w01ps01.txt [CERT] NAME=defult ORG=defult OU=defult LOC=SFO ST=defult CC=defult CN=sfo01w01ps01.sfo01.rinpole.lol keysize=defult [SAN] sfo01w01ps01 sfo01w01ps01.sfo01.rinpole.lol 7 Open Windows PowerShell prompt nd nvigte to the CertGenVVD folder. d C:\CertGenVVD-version 8 Grnt permissions to run third-prty PowerShell sripts. Set-ExeutionPoliy Unrestrited 9 Vlidte if you n run the utility using the onfigurtion on the host nd verify if VMwre is inluded in the printed CA templte poliy..\certgenvvd-version.ps1 -vlidte 10 Generte MSCA-signed ertifites..\certgenvvd-version.ps1 -MSCASigned -ttri 'CertifiteTemplte:VMwre' -inter 11 In the C:\CertGenVVD-version folder, verify tht the utility reted the SignedByMSCACerts sufolder. Wht to do next Reple the produt ertifites with the ertifites tht the CertGenVVD utility hs generted. See Chpter 4 Reple the Certifites of the Mngement Produts for Consolidted SDDC. VMwre, In. 9

10 Generte Certifite Signing Requests nd Certifites from Third-Prty CA for Consolidted SDDC 3 Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifite signing request (CSR) files for the mngement omponents in the Consolidted SDDC tht you n send to third-prty ertifite uthority. After you reeive the CA-signed ertifites, run the CertGenVVD utility to onvert the ertifite for eh omponent in the formt tht the omponent supports. You n then reple the ertifites on these omponents, for exmple, if they re out to expire or re ompromised. Prerequisites Provide Windows Server 2012 host tht is tht hs ess to your dt enter. 1 Log in to Windows host tht hs ess to your dt enter. 2 Downlod the CertGenVVD-version.zip file of the Certifite Genertion Utility from VMwre Knowledge Bse rtile on the Windows host where you onnet to the dt enter nd extrt the ZIP file to the C: drive. 3 In the C:\CertGenVVD-version folder, open the defult.txt file in text editor. 4 Verify tht following properties re onfigured. ORG=Rinpole In. OU=Rinpole.lol LOC=SFO ST=CA CC=US CN=VMwre_VVD keysize= Verify tht only the C:\CertGenVVD-version\ConfigFiles folder ontins only following files. Tle 3 1. Certifite Genertion Files for Consolidted SDDC SDDC Lyer Host Nme or Servie in Consolidted SDDC Configurtion Files Virtul Infrstruture Lyer Pltform Servies Controller sfo01w01ps01.sfo01.rinpo le.lol sfo01w01ps01.txt vcenter Server sfo01w01v01.sfo01.rinpol e.lol sfo01w01v01.txt VMwre, In. 10

11 Certifite Replement Tle 3 1. Certifite Genertion Files for Consolidted SDDC (Continued) SDDC Lyer Host Nme or Servie in Consolidted SDDC Configurtion Files ESXi Hosts NSX Mnger sfo01w01esx01.sfo01.rinpo le.lol sfo01w01esx02.sfo01.rinpol e.lol sfo01w01esx03.sfo01.rinpol e.lol sfo01w01esx04.sfo01.rinpol e.lol sfo01w01nsx01.sfo01.rinpo le.lol sfo01w01esx01.txt sfo01w01esx02.txt sfo01w01esx03.txt sfo01w01esx04.txt sfo01w01nsx01.txt Business Continuity vsphere Dt Protetion sfo01w01vdp01.sfo01.rinpo le.lol sfo01w01vdp01.txt Cloud Mngement Pltform Lyer vrelize Automtion vr01svr01.rinpole.lo l vr01svr01.rinpole.lo l vr01iws01.rinpole.lo l vr01iws01.rinpole.lo l vr01ims01.rinpole.lo l vr01ims01.rinpole.lo l vr-for-1-pod.txt vrelize Business Server vr01svr01.rinpole.lol vr.txt Opertions Mngement Lyer vrelize Opertions Mnger vrops01svr01.rinpole.lo l vrops-for-1-pod.txt vrops01svr01.rinpole.l ol vrelize Log Insight sfo01vrli01.sfo01.rinpol e.lol sfo01vrli01.sfo01.rinp ole.lol vrli-for-1-pod.txt 6 Verify tht eh onfigurtion file inludes FQDN nd host nmes in the dedited setions. For exmple, the onfigurtions files for the Pltform Servie Controller instnes must ontin the following properties: VMwre, In. 11

12 Certifite Replement sfo01w01ps01.txt [CERT] NAME=defult ORG=defult OU=defult LOC=SFO ST=defult CC=defult CN=sfo01w01ps01.sfo01.rinpole.lol keysize=defult [SAN] sfo01w01ps01 sfo01w01ps01.sfo01.rinpole.lol 7 Open Windows PowerShell prompt nd nvigte to the folder of the CertGenVVD utility. d C:\CertGenVVD-version 8 Grnt permissions to run third-prty PowerShell sripts. Set-ExeutionPoliy Unrestrited 9 Vlidte if you n run the utility using the onfigurtion on the host nd verify if VMwre is inluded in the printed CA templte poliy..\certgenvvd-version.ps1 -vlidte 10 Generte ertifite request files for the mngement omponents in the SDDC..\CertGenVVD-version.ps1 -CSR 11 Lote the CSR files in the C:\CertGenVVD-version\CSRCerts folder nd send it to the third-prty CA to get the signed ertifites. 12 After you otin ll the signed ertifite files nd the root CA ertifite, move the signed ertifite files k to eh diretory where the CSR files reside. 13 In ommnd prompt, nvigte to the folder tht ontins the CA root ertifite nd renme it to Root64.er. 14 If the ertifites re signed y multiple intermedite CAs, ontente the ertifites in one ertifite hin file y running the following ommnd. opy IntermediteCAroot01.er+IntermediteCAroot02.er+RootCA.er > Root64.er 15 Move the Root64.er to the C:\CertGenVVD-version\CSRCerts\Root64 folder. VMwre, In. 12

13 Certifite Replement 16 Run CertGenVVD tool with the -CSR nd -extr ommnd options to generte ll ertifites tht re required for the SDDC mngement omponents..\certgenvvd-version.ps1 CSR -extr 17 After CertGenVVD genertes the ertifites, go to C:\CertGenVVD-version\CSRCerts\Root64 folder nd renme Root64.er to hinroot64.er. Wht to do next Reple the produt ertifites with the ertifites tht the CertGenVVD utility hs generted. See Chpter 4 Reple the Certifites of the Mngement Produts for Consolidted SDDC. VMwre, In. 13

14 Reple the Certifites of the Mngement Produts for Consolidted SDDC 4 After you generte ertifites for mngement produts tht re signed y the two-lyered ertifite uthority on the hild AD server in the region, reple the defult ertifite or ertifite tht is out to expire with newly-signed one. Prerequisites Use the VMwre Vlidted Design Certifite Utility. See Chpter 2 Generte MSCA-Signed Certifites for the SDDC Mngement Components nd Chpter 3 Generte Certifite Signing Requests nd Certifites from Third-Prty CA for Consolidted SDDC. 1 Reple Certifites of the Virtul Infrstruture Components for Consolidted SDDC If the user-fing ertifites of the mngement omponents in the Consolidted SDDC re out to expire or re ompromised, you reple them with ertifites tht re signed y Mirosoft or nother ertifite uthority. You strt from Pltform Servies Controller, vcenter Server nd ESXi euse these omponents re onneted to the omponents in the opertions mngement nd loud mngement lyers. 2 Reple Certifites of the Cloud Mngement Pltform Components for Consolidted SDDC After you generte signed ertifites for the omponents of the Cloud Mngement Pltform y using the CertGenVVD utility, reple them on these omponents. Updte the new ertifites on the mngement omponents in the Consolidted SDDC to mintin the trusted onnetion. 3 Reple Certifites of the Opertions Mngement Components for Consolidted SDDC If the ertifite of vrelize Opertions Mnger or vrelize Log Insight is out to expire or is ompromised, reple it nd updte it on the mngement omponents in the Consolidted SDDC to mintin trusted onnetion. Generte the ertifite using the CertGenVVD utility so tht it is omplint with this design nd with the requirements of vrelize Opertions Mnger. VMwre, In. 14

15 Certifite Replement Reple Certifites of the Virtul Infrstruture Components for Consolidted SDDC If the user-fing ertifites of the mngement omponents in the Consolidted SDDC re out to expire or re ompromised, you reple them with ertifites tht re signed y Mirosoft or nother ertifite uthority. You strt from Pltform Servies Controller, vcenter Server nd ESXi euse these omponents re onneted to the omponents in the opertions mngement nd loud mngement lyers. Infrstruture dministrtors onnet to different SDDC omponents, suh s vcenter Server or Pltform Servies Controller from We rowser to perform onfigurtion, mngement nd trouleshooting. The uthentiity of the network node to whih the dministrtor onnets must e onfirmed with vlid TLS/SSL ertifite. You do not reple ertifites for mhine-to-mhine ommunition. If neessry, you n mnully mrk these ertifites s trusted. 1 Reple the Pltform Servies Controller Certifite for Consolidted SDDC Reple the ertifite of the Pltform Servies Controller instne in Consolidted SDDC. Reonnet the Pltform Servies Controller to the vcenter Server nd NSX Mnger instnes to updte the ertifites for vcenter Single Sign-on on these omponents. 2 Reple the vcenter Server Certifite for Consolidted SDDC Reple the ertifite on the Consolidted vcenter Server if it is out to expire nd reonnet vcenter Server to the other mngement omponents to updte the new ertifite on these omponents for trusted ommunition. 3 Reple the ESXi Host Certifites in Consolidted SDDC Reple the defult or ertifites tht re out to expire on the ESXi hosts with ertifites tht re generted y using the CertGenVVD utility. By defult, eh new ESXi host is provisioned with signed ertifite tht hs VMwre Certifite Authority s the root ertifite uthority. 4 Reple the NSX Mnger Certifites for Consolidted SDDC After you reple the ertifites of the Pltform Servies Controller instne nd the vcenter Server instne, reple the ertifites for the NSX Mnger instne. Re-estlish the trusted onnetion to vcenter Server nd Pltform Servies Controller, nd to vrelize Opertions Mnger. 5 Reple Certifite on vsphere Dt Protetion for Consolidted SDDC After you use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifites for the SDDC mngement omponents, reple the ertifite on vsphere Dt Protetion if it is out to expire or is ompromised. VMwre, In. 15

16 Certifite Replement Reple the Pltform Servies Controller Certifite for Consolidted SDDC Reple the ertifite of the Pltform Servies Controller instne in Consolidted SDDC. Reonnet the Pltform Servies Controller to the vcenter Server nd NSX Mnger instnes to updte the ertifites for vcenter Single Sign-on on these omponents. 1 Reple the Pltform Servies Controller Certifite Files for Consolidted SDDC After you generte the SDDC mngement ertifites y using the CertGenVVD utility on Windows host tht hs ess to the dt enter, reple the SSL ertifite on the Pltform Servies Controller instne in the Consolidted SDDC with ustom ertifite tht is signed y the ertifite uthority (CA). 2 Updte the Pltform Servies Controller Certifite on the Mngement Components for Consolidted SDDC After you reple the ertifite of the Pltform Servies Controller instne, updte the ertifite on vcenter Server nd NSX Mnger to re-estlish trusted ommunition. Wht to do next If you reple the ertifite of vcenter Server fter the Pltform Servies Controller, see Reple the vcenter Server Certifite Files for Consolidted SDDC. Reple the Pltform Servies Controller Certifite Files for Consolidted SDDC After you generte the SDDC mngement ertifites y using the CertGenVVD utility on Windows host tht hs ess to the dt enter, reple the SSL ertifite on the Pltform Servies Controller instne in the Consolidted SDDC with ustom ertifite tht is signed y the ertifite uthority (CA). The ertifite must hve ommon nme tht is equl to the Fully Qulified Domin Nme (FQDN) of the Pltform Servies Controller. The short nme of the Pltform Servies Controller must e in the Sujet Alternte Nme (SAN) of the generted ertifite. Tle 4 1. Certifite-Relted Files on Pltform Servies Controller Pltform Servies Controller Certifite File Nme sfo01w01ps01.sfo01.rinpole.lol sfo01w01ps01.key sfo01w01ps01.1.er hinroot64.er VMwre, In. 16

17 Certifite Replement 1 Log in to the Pltform Servies Controller y using Seure Shell (SSH) lient. Open n SSH onnetion to sfo01w01ps01.sfo01.rinpole.lol. Log in using the following redentils. User nme Pssword Vlue root sfo01m01ps01_root_pssword 2 Run the following ommnd to enle Bsh shell ess for the root user. shell hsh -s "/in/sh" root 3 Copy the generted ertifites from the Windows host to the Pltform Servies Controller. Run the following ommnd to rete new temporry folder mkdir -p /root/erts Copy the ertifite files sfo01w01ps01.1.er, sfo01w01ps01.key nd hinroot64.er to the /root/erts folder. You n use n sp softwre like WinSCP. 4 Reple the ertifite on the Pltform Servies Controller. Strt the vsphere Certifite Mnger utility on the Pltform Servies Controller. /usr/li/vmwre-vm/in/ertifite-mnger d e f g Selet Option 1 (Reple Mhine SSL ertifite with Custom Certifite). Enter the defult vcenter Single Sign-On user nme dministrtor@vsphere.lol nd the vsphere_dmin pssword. Selet Option 2 (Import ustom ertifite(s) nd key(s) to reple existing Mhine SSL ertifite). When prompted for the ustom ertifite, enter /root/erts/sfo01w01ps01.1.er. When prompted for the ustom key, enter /root/erts/sfo01w01ps01.key. When prompted for the signing ertifite, enter /root/erts/hinroot64.er. h When prompted to Continue opertion, enter Y. i The Pltform Servies Controller servies restrts utomtilly. VMwre, In. 17

18 Certifite Replement 5 Verify tht the new ertifite hs een instlled suessfully. Open We Browser nd go to Verify tht the We rowser shows the new ertifite. 6 After Certifite Mnger reples the ertifites, run the following ommnds in the SSH terminl to restrt the vmi-lighttp servie nd to remove ertifite files. servie vmi-lighttp restrt d /root/erts rm sfo01w01ps01.1.er sfo01w01ps01.key hinroot64.er 7 Swith the shell k to the ppline shell. hsh -s /in/pplinesh root Updte the Pltform Servies Controller Certifite on the Mngement Components for Consolidted SDDC After you reple the ertifite of the Pltform Servies Controller instne, updte the ertifite on vcenter Server nd NSX Mnger to re-estlish trusted ommunition. 1 Restrt the servies of the Consolidted vcenter Server. Open n SSH onnetion to sfo01w01v01.sfo01.rinpole.lol. Log in using the following redentils. User nme Pssword Vlues root sfo01w01v01_root_pssword Swith from the vcenter Server Appline ommnd shell to the Bsh shell. shell d Restrt vcenter Server servies y using the following ommnd. servie-ontrol --stop --ll servie-ontrol --strt --ll 2 Reonnet NSX Mnger to Pltform Servies Controller nd to vcenter Server fter you instll the ustom ertifites on the nodes. See Connet NSX Mnger to the Consolidted vcenter Server After Certifite Replement. VMwre, In. 18

19 Certifite Replement Reple the vcenter Server Certifite for Consolidted SDDC Reple the ertifite on the Consolidted vcenter Server if it is out to expire nd reonnet vcenter Server to the other mngement omponents to updte the new ertifite on these omponents for trusted ommunition. 1 Reple the vcenter Server Certifite Files for Consolidted SDDC After you generte the SDDC mngement ertifites y using the CertGenVVD utility on Windows host tht hs ess to the dt enter, reple the ertifite of the Consolidted vcenter Server over SSH using the vsphere Certifite Mnger. 2 Connet NSX Mnger to the Consolidted vcenter Server After Certifite Replement After you reple the ertifites of the Pltform Servies Controller nd vcenter Server instnes, you reonnet NSX Mnger to these omponents to updte their ertifites on NSX Mnger. You must re-estlishing the trusted onnetion to the Lookup Servie vcenter Single Sign-On on Pltform Servies Controller nd to the vsphere We Servie API on vcenter Server. 3 Connet vsphere Dt Protetion to the Consolidted vcenter Server After Certifite Replement After you reple the ertifite on the Consolidted vcenter Server, to updte the ertifite on vsphere Dt Protetion, onnet vsphere Dt Protetion to vcenter Server to re-estlish trusted onnetion for kup nd restore of virtul mhines. 4 Updte the Certifite of vcenter Server on the Cloud Mngement Pltform for Consolidted SDDC After you reple the ertifites on the Consolidted vcenter Server, reonnet vrelize Orhestrtor, vrelize Business nd vrelize Automtion to the vcenter Server to updte the vcenter Server ertifite on the Cloud Mngement Pltform. You must re-estlish the trusted onnetion. 5 Updte the Certifite of vcenter Server on vrelize Opertions Mnger for Consolidted SDDC After you hnge the ertifite of the Consolidted vcenter Server, updte the ertifite on the onneted vrelize Opertions Mnger node y reonneting the vcenter Adpter nd vsan Adpter. You must re-estlish the trusted onnetion. Reple the vcenter Server Certifite Files for Consolidted SDDC After you generte the SDDC mngement ertifites y using the CertGenVVD utility on Windows host tht hs ess to the dt enter, reple the ertifite of the Consolidted vcenter Server over SSH using the vsphere Certifite Mnger. You reple ertifites the vcenter Server sfo01w01v01.sfo01.rinpole.lol here. VMwre, In. 19

20 Certifite Replement Tle 4 2. Certifite-Relted Files on the vcenter Server Instnes vcenter Server FQDN Files for Certifite Replement sfo01w01v01.sfo01.rinpole.lol sfo01w01v01.key sfo01w01v01.1.er hinroot64.er Prerequisites CA-signed ertifite files generted y using VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD). See the VMwre Vlidted Design Plnning nd Preprtion doumenttion. A Windows host with n SSH terminl ess softwre suh s PuTTY nd n sp softwre suh s WinSCP instlled. 1 Chnge the vcenter Server Appline ommnd shell to the Bsh shell to llow seure opy (sp) onnetions. Open n SSH onnetion to sfo01w01v01.sfo01.rinpole.lol. Log in using the following redentils. User nme Pssword Vlue root venter_server_root_pssword Run the following ommnd to enle Bsh shell ess for the root user. shell hsh -s "/in/sh" root 2 Copy the generted ertifites from the Windows host to the vcenter Server Appline. Run the following ommnd to rete new temporry folder mkdir -p /root/erts Copy the ertifite files sfo01m01v01.1.er, sfo01w01v01.key, nd hinroot64.erfrom the Windows host where you run the CertGenVVD utility to the /root/erts folder. You n use n sp softwre suh s WinSCP. VMwre, In. 20

21 Certifite Replement 3 Reple the CA-signed ertifite on the vcenter Server instne. Strt the vsphere Certifite Mnger utility on the vcenter Server instne. /usr/li/vmwre-vm/in/ertifite-mnger Selet Option 1 (Reple Mhine SSL ertifite with Custom Certifite), enter the defult vcenter Single Sign-On user nme dministrtor@vsphere.lol nd the vsphere_dmin_pssword pssword. When prompted for the Infrstruture Server IP, enter the IP ddress of the Pltform Servies Controller. Pltform Servies Controller Address IP Address of Pltform Servies Controller sfo01w01ps01.sfo01.rinpole.lol d e Selet Option 2 (Import ustom ertifite(s) nd key(s) to reple existing Mhine SSL ertifite). When prompted, provide the full pth to the ustom ertifite, the root ertifite file nd the key file tht you generted erlier, nd onfirm the import with Yes (Y). vcenter Server sfo01w01v01.sfo01.rinpole.lol Input to the vsphere Certifite Mnger Utility Plese provide vlid ustom ertifite for Mhine SSL. File : /root/erts/sfo01w01v01.1.er Plese provide vlid ustom key for Mhine SSL. File : /root/erts/sfo01w01v01.key Plese provide the signing ertifite of the Mhine SSL ertifite. File : /root/erts/hinroot64.er 4 After Sttus shows 100% Completed, wit severl minutes until ll vcenter Server servies re restrted. 5 Open the vsphere We lient to verify tht ertifite replement is suessful. Open We rowser nd go to Verify tht you see the new ertifite. 6 Run the following ommnds to restrt the vmi-lighttp servie nd to remove ertifite files. servie vmi-lighttp restrt d /root/erts rm sfo01w01v01.1.er sfo01w01v01.key hinroot64.er VMwre, In. 21

22 Certifite Replement Connet NSX Mnger to the Consolidted vcenter Server After Certifite Replement After you reple the ertifites of the Pltform Servies Controller nd vcenter Server instnes, you reonnet NSX Mnger to these omponents to updte their ertifites on NSX Mnger. You must reestlishing the trusted onnetion to the Lookup Servie vcenter Single Sign-On on Pltform Servies Controller nd to the vsphere We Servie API on vcenter Server. 1 Log in to the NSX Mnger ppline user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin nsx_mnger_dmin_pssword 2 Clik Mnge vcenter Registrtion. 3 Under Lookup Servie, lik Edit. 4 In the Lookup Servie dilog ox, enter the following settings nd lik OK. Lookup Servie IP Vlue for NSX Mnger Instnes sfo01w01ps01.sfo01.rinpole.lol Lookup Servie Port 443 SSO Administrtor User Nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 5 In the Trust Certifite? dilog ox, lik Yes. 6 Under vcenter Server, lik Edit. 7 In the vcenter Server dilog ox, enter the following settings nd lik OK. vcenter Server vcenter User Nme Pssword Vlue for NSX Mnger for the Consolidted SDDC sfo01w01v01.sfo01.rinpole.lol sv-nsxmnger@rinpole.lol sv-nsxmnger_pssword 8 In the Trust Certifite? dilog ox, lik Yes. 9 Wit for the Sttus inditors for the Lookup Servie nd vcenter Server to hnge to the Conneted sttus. VMwre, In. 22

23 Certifite Replement Connet vsphere Dt Protetion to the Consolidted vcenter Server After Certifite Replement After you reple the ertifite on the Consolidted vcenter Server, to updte the ertifite on vsphere Dt Protetion, onnet vsphere Dt Protetion to vcenter Server to re-estlish trusted onnetion for kup nd restore of virtul mhines. 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 2 On the vsphere We Client Home pge, lik the VDP ion. 3 On the Welome to vsphere Dt Protetion pge, selet sfo01w01vdp01 from the VDP Appline drop-down menu nd lik Connet. Updte the Certifite of vcenter Server on the Cloud Mngement Pltform for Consolidted SDDC After you reple the ertifites on the Consolidted vcenter Server, reonnet vrelize Orhestrtor, vrelize Business nd vrelize Automtion to the vcenter Server to updte the vcenter Server ertifite on the Cloud Mngement Pltform. You must re-estlish the trusted onnetion. 1 Reonnet vrelize Orhestrtor to vcenter Server. Open We Browser nd go to Clik Strt Orhestrtor Client. On the VMwre vrelize Orhestrtor login pge, log in to the emedded vrelize Orhestrtor y using the following host nme nd redentils. Host nme User nme Pssword Vlue sv-vr sv-vr-pssword d e In the left pne, lik Workflows, nd nvigte to Lirry > vcenter > Configurtion. Right-lik the Updte vcenter Server instne workflow nd lik Strt Workflow. VMwre, In. 23

24 Certifite Replement f g h From the vcenter Server instne drop-down menu, selet nd lik Next. Enter the pssword for the sv-vro@rinpole.lol user ount nd lik Sumit. Clik Yes to ignore the ertifite wrnings nd lik Next. 2 Reonnet vrelize Business to the Consolidted vcenter Server. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue root vr_olletor_root_pssword d e f Clik Mnge Privte Cloud Connetions, selet vcenter Server, selet the sfo01w01v01.sfo01.rinpole.lol entry nd lik the Edit ion. In the Edit vcenter Server Connetion dilog ox, enter the pssword for the svvr@rinpole.lol user nd lik Sve. In the SSL Certifite wrning dilog ox, lik Instll. In the Suess dilog ox, lik OK. 3 Rerete the vsphere endpoint in vrelize Automtion. Open We rowser nd go to Log in using the following redentils. User nme Pssword Domin Vlue it-tenntdmin it-tenntdmin_pssword rinpole.lol d e Nvigte to Infrstruture > Endpoints > Endpoints. Hve your mouse over sfo01w01v01.sfo01.rinpole.lol nd lik Edit from the menu. On the Edit Endopint - vsphere (vcenter) pge, lik OK. f In the ertifite wrning dilog ox, lik OK to ept the new ertifite. Updte the Certifite of vcenter Server on vrelize Opertions Mnger for Consolidted SDDC After you hnge the ertifite of the Consolidted vcenter Server, updte the ertifite on the onneted vrelize Opertions Mnger node y reonneting the vcenter Adpter nd vsan Adpter. You must re-estlish the trusted onnetion. VMwre, In. 24

25 Certifite Replement 1 Log in to vrelize Opertions Mnger y using the opertions interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrops_dmin_pssword 2 On the min nvigtion r, lik Administrtion. 3 In the left pne of vrelize Opertions Mnger, under Mngement, lik Certifites. 4 Selet the row tht ontins CN=sfo01w01v01.sfo01.rinpole.lol nd lik the Delete ion. 5 Reonnet the VMwre vsan dpter for the onsolidted luster. In the left pne of vrelize Opertions Mnger, lik Solutions. Selet the VMwre vsphere solution nd lik Configure. In the Mnge Solutions dilog ox, selet vcenter Adpter - sfo01w01v01, lik Test Connetion, ept the new ertifite of the Conoslidted vcenter Server, nd lik Sve s. 6 Reonnet the VMwre vsan dpter for the onsolidted luster. In the left pne of vrelize Opertions Mnger, lik Solutions. Selet the VMwre vsan solution nd lik Configure. In the Mnge Solutions dilog ox, selet vsan Adpter - sfo01w01v01, lik Test Connetion, ept the new ertifite of the Consolidted vcenter Server, nd lik Sve s. Reple the ESXi Host Certifites in Consolidted SDDC Reple the defult or ertifites tht re out to expire on the ESXi hosts with ertifites tht re generted y using the CertGenVVD utility. By defult, eh new ESXi host is provisioned with signed ertifite tht hs VMwre Certifite Authority s the root ertifite uthority. In eh luster, efore you reple the present ertifites on host, onfigure the ertifite mode for hosts to support ustom ertifite uthorities (CAs). VMwre, In. 25

26 Certifite Replement 1 Set the Host Certifite Mode on the Consolidted vcenter Server to Support Custom Certifite Authority By defult the ESXi hosts re utomtilly provisioned with VMwre Certifite Authority (VMCA) ertifites when they re onneted to vcenter Server. Set the host ertifite mode on the vcenter Server to support ustom ertifite uthority. In this wy, vcenter Server stops pushing VMCA ertifites on to the ESXi hosts fter you uplod ertifite tht is signed y third-prty CA. 2 Reple the Defult Certifites with Custom Certifites on the ESXi Hosts for Consolidted SDDC After you generte signed ertifites for the ESXi hosts y using the CertGenVVD utility nd onfigure vcenter Server to ept ustom ertifite uthorities, reple the present ertifites with the ustom ones on the hosts. You reple host ertifites if they re out to expire, re VMCA-signed or re ompromised. Set the Host Certifite Mode on the Consolidted vcenter Server to Support Custom Certifite Authority By defult the ESXi hosts re utomtilly provisioned with VMwre Certifite Authority (VMCA) ertifites when they re onneted to vcenter Server. Set the host ertifite mode on the vcenter Server to support ustom ertifite uthority. In this wy, vcenter Server stops pushing VMCA ertifites on to the ESXi hosts fter you uplod ertifite tht is signed y third-prty CA. vcenter Server sfo01w01v01.sfo01.rinpole.lol ESXi Host sfo01w01esx01.sfo01.rinpole.lol sfo01w01esx02.sfo01.rinpole.lol sfo01w01esx03.sfo01.rinpole.lol sfo01w01esx04.sfo01.rinpole.lol 1 Ensure tht ll CA ertifites from vcenter Server re updted on ll hosts. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vshpere_dmin_pssword d e In the Nvigtor, under Hosts nd Cluster, selet sfo01m01esx01.sfo01.rinpole.lol, nd lik the Configure t. Under System, selet Certifite nd lik Refresh CA Certifites. Repet the steps for the other ESXi hosts in the onsolidted luster. VMwre, In. 26

27 Certifite Replement 2 Chnge the ertifite mode for the ESXi hosts in the onsolidted luster to ustom. d In the Nvigtor, under Hosts nd Cluster, selet sfo01w01v01.sfo01.rinpole.lol, nd lik the Configure t. Under s, lik Advned s nd lik Edit. In the filter ox, enter ertmgmt nd press Enter to view only ertifite mngement properties. Chnge the vlue of the vpxd.ertmgmt.mode property to ustom nd lik OK. 3 Restrt the vcenter Server Appline to pply the hnges. Open We rowser nd go to Log in using the following redentils. s User nme Pssword Vlues root mgmt_v_server_pssword Clik Reoot to restrt the vcenter Server Appline. Reple the Defult Certifites with Custom Certifites on the ESXi Hosts for Consolidted SDDC After you generte signed ertifites for the ESXi hosts y using the CertGenVVD utility nd onfigure vcenter Server to ept ustom ertifite uthorities, reple the present ertifites with the ustom ones on the hosts. You reple host ertifites if they re out to expire, re VMCA-signed or re ompromised. You reple the ertifite seprtely on eh hosts in the onsolidted luster. Tle 4 3. Certifite Files Nmes for the ESXi hosts ESXi Hosts Certifite File Nmes sfo01w01esx01.sfo01.rinpole.lol sfo01w01esx01.key sfo01w01esx01.1.er sfo01w01esx02.sfo01.rinpole.lol sfo01w01esx02.key sfo01w01esx02.1.er sfo01w01esx03.sfo01.rinpole.lol sfo01w01esx03.key sfo01w01esx03.1.er sfo01w01esx04.sfo01.rinpole.lol sfo01w01esx04.key sfo01w01esx04.1.er VMwre, In. 27

28 Certifite Replement 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 2 Disle lokdown mode on the sfo01w01esx01.sfo01.rinpole.lol host. d e f g h From the Home menu of the vsphere We Client, selet Hosts nd Clusters. In the Nvigtor, expnd the sfo01w01v01 > sfo01-w01d > sfo01-w01-onsolidted01 tree, selet the sfo01w01esx01.sfo01.rinpole.lol host ojet, nd lik the Configure t on the right. Under System, lik Seurity Profile, sroll down to Lokdown Mode, nd lik Edit. In the Lokdown Mode dilog ox, selet Disled nd lik OK. Sroll up to the Servies pne nd lik Edit. In Edit Seurity Profile dilog ox, selet SSH Clik on Strt utton if the sttus is not showing up s Running Clik on OK to lose the Edit Seurity Profile Pop up Window. 3 Ple the host in mintenne mode. Right-lik the sfo01w01esx01.sfo01.rinpole.lol host ojet nd selet Mintenne Mode > Enter Mintenne Mode. In the Confirm Mintenne Mode dilog ox, selet Move powered-off nd suspended virtul mhines to other hosts in the luster nd lik OK. VMwre, In. 28

29 Certifite Replement 4 Reple the ertifite files on the host. After the mintenne tsk is omplete, open n SSH onnetion to the sfo01w01esx01.sfo01.rinpole.lol host using the following redentils. Option User nme Pssword Desription root esxi_root_user_pssword Copy the sfo01w01esx01.key nd sfo01w01esx01.1.er files from the Windows host where you run the CertGenVVD tool to the /et/vmwre/ssl diretory on the host. Run the following ommnds to k up the present ertifite nd key files nd to reple them with the generted files. d /et/vmwre/ssl t rui.rt >> rui.k t rui.key >> rui.k mv sfo01w01esx01.key rui.key mv sfo01w01esx01.1.er rui.rt 5 Restrt the mngement gents on the host. d e f g Run the dui ommnd to open the Diret Console User Interfe (DCUI). Press the F12 key to ess the System Customiztion menu. Selet Trouleshooting Options nd press Enter. Selet Restrt Mngement Agents nd press Enter. Press F11 key to onfirm the restrt nd press Enter to onfirm ompletion. Press Control-C to lose dui pplition. Run the following ommnds to restrt the vsnvpd nd vsnmgmtd servies /et/init.d/vsnvpd restrt /et/init.d/vsnmgmtd restrt 6 Verify tht the ustom ertifite is instlled. Open We rowser nd go to Verify tht the ertifite returned y the host is signed y Rinpole insted of y VMwre. VMwre, In. 29

30 Certifite Replement 7 Exit mintenne mode of the host. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vshpere_dmin_pssword d e From the Home menu, selet Hosts nd Clusters. Under the sfo01-w01d dt enter, right-lik the sfo01w01esx01.sfo01.rinpole.lol host ojet nd selet Mintenne Mode > Exit Mintenne Mode. Mke sure tht no wrning messge out n untrusted sfo01w01esx01.sfo01.rinpole.lol ertifite ppers. 8 Reonnet the ESXi host to vcenter Server to updte the host ertifite on vcenter Server. Expnd the sfo01w01v01 > sfo01-w01d > sfo01-w01-onsolidted01 tree, right-lik the sfo01w01esx01.sfo01.rinpole.lol host ojet nd selet Connetion > Disonnet. Clik Yes in the Confirm Disonnet popup window. Wit until the host is disonneted. d Right-lik the sfo01w01esx01.sfo01.rinpole.lol host ojet nd selet Connetion > Connet. e f In the Nvigtor, under Hosts nd Cluster, selet sfo01w01esx01.sfo01.rinpole.lol, nd lik the Configure t. Under System, selet Certifites nd verify tht the ertifite displyed for the host is the new one. 9 Verify tht the storge providers re online for the ESXi host. d In the Nvigtor, selet the sfo01w01v01.sfo01.rinpole.lol vcenter Server ojet nd lik the Configure t. Under More, selet Storge Providers. Verify tht the sttus for the /version.xml URL of the vsan storge provider is Online. If the sttus of the URL is different from Online, selet the URL, lik the Unregister the seleted storge provider ion, nd lik Synhronizes ll the storge providers with the urrent sttes of the environment ion. 10 Repet the proedure for the rest of the ESXi hosts in the onsolidted luster. VMwre, In. 30

31 Certifite Replement Reple the NSX Mnger Certifites for Consolidted SDDC After you reple the ertifites of the Pltform Servies Controller instne nd the vcenter Server instne, reple the ertifites for the NSX Mnger instne. Re-estlish the trusted onnetion to vcenter Server nd Pltform Servies Controller, nd to vrelize Opertions Mnger. You reple the ertifite on the NSX Mnger y using the We interfe. Tle 4 4. Certifite-Relted Files on NSX Mnger NSX Mnger FQDN sfo01w01nsx01.sfo01.rinpole.lol Certifite File Nme sfo01w01nsx01.4.p12 1 On the Windows host tht hs ess to the dt enter, log in to the NSX Mnger We interfe. Open We rowser nd go to following URL. NSX Mnger NSX Mnger for the onsolidted luster URL Log in using the following redentils. Vlue User nme dmin Pssword nsx_mnger_dmin_pssword 2 On the Home pge, selet Mnge Appline s. 3 On the Mnge t, lik SSL Certifites, lik Uplod PKCS#12 Keystore 4 Browse to the ertifite hin file sfo01w01nsx01.4.p12, provide the keystore pssword or pssphrse nd lik Import. 5 Restrt NSX Mnger to updte the CA-signed ertifite. In the right orner of the NSX Mnger pge, lik the s ion. From the drop-down menu, selet Reoot Appline. VMwre, In. 31

32 Certifite Replement 6 Re-register the NSX Mnger to the Consolidted vcenter Server nd Pltform Servies Controller pir. Open We rowser nd go to the NSX Mnger We interfe. NSX Mnger for Consolidted SDDC Vlue Log in using the following redentils. Vlue User nme dmin Pssword nsx_mngr_dmin_pssword d e Clik Mnge vcenter Registrtion. Under Lookup Servie ULR, lik the Edit utton. In the Lookup Servie URL dilog ox, enter the following settings, nd lik OK. Lookup Servie IP Vlue sfo01w01ps01.sfo01.rinpole.lol Lookup Servie Port 443 SSO Administrtor User Nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword f g h In the Trust Certifite? dilog ox, lik Yes. Under vcenter Server, lik the Edit utton. In the vcenter Server dilog ox, enter the following settings, nd lik OK. vcenter Server vcenter User Nme Pssword Vlue for the NSX Mnger for Consolidted SDDC sfo01w01v01.sfo01.rinpole.lol sv-nsxmnger@rinpole.lol sv-nsxmnger_pssword i j In the Trust Certifite? dilog ox, lik Yes. Wit until the Sttus inditors for the Lookup Servie nd vcenter Server hnge to Conneted. VMwre, In. 32

33 Certifite Replement 7 Reonnet the NSX Mnger instnes to vrelize Opertions Mnger. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrops_dmin_pssword d e On the min nvigtion r, lik Administrtion. In the left pne of vrelize Opertions Mnger, lik Certifites under Mngement. Delete the ertifites with the following CNs. u CN=sfo01w01nsx01.sfo01.rinpole.lol f g h i In the left pne of vrelize Opertions Mnger, lik Solutions. From the solution tle on the Solutions pge, selet the Mngement Pk for NSX-vSphere solution, nd lik the Configure ion t the top. In the Mnge Solutions dilog ox, from the Adpter Type tle t the top, selet NSXvSphere Adpter. Clik the sfo01w01nsx01-sfo01 dpter instne, lik Test Connetion, ept the new ertifite, lik Sve settings, nd lik Close. Reple Certifite on vsphere Dt Protetion for Consolidted SDDC After you use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifites for the SDDC mngement omponents, reple the ertifite on vsphere Dt Protetion if it is out to expire or is ompromised. 1 Log in to the vsphere Dt Protetion ppline. Open n SSH onnetion to the virtul mhine sfo01w01vdp01.sfo01.rinpole.lol. Log in using the following redentils. User nme Pssword Vlue root vdp_root_pssword VMwre, In. 33

34 Certifite Replement 2 Stop the vsphere Dt Protetion We servies y running the following ommnd. emwepp.sh --stop Note If you see errors relted to dtse server, ignore them. 3 Delete the tomt lis from the Jv keystore y running the following ommnd. /usr/jv/ltest/in/keytool -delete -lis tomt -storepss hngeit 4 Copy the.keystore file generted y CertGenVVD tool to the /tmp folder on the vsphere Dt Protetion virtul ppline. You n use FileZill or WinSCP. 5 Run the following ommnd to insert the new ertifition hin in to the keystore. /usr/jv/ltest/in/keytool -importkeystore -srkeystore /tmp/.keystore -- destkeystore /root/.keystore -srstorepss hngeit -deststorepss hngeit 6 Run the following ommnd nd in the ommnd output verify tht the ertifite entry with the tomt lis exists in the keystore. /usr/jv/ltest/in/keytool -list -v -keystore /root/.keystore -storepss hngeit -keypss hngeit 7 If the ertifite entry exists in the keystore, run the ddfingerprint.sh sript to updte the vsphere Dt Protetion server thumprint. /usr/lol/vmr/in/ddfingerprint.sh 8 Strt the vsphere Dt Protetion We servies y running the following ommnd. emwepp.sh --strt 9 Run the following ommnd to remove the /tmp/.keystore file. rm /tmp/.keystore Reple Certifites of the Cloud Mngement Pltform Components for Consolidted SDDC After you generte signed ertifites for the omponents of the Cloud Mngement Pltform y using the CertGenVVD utility, reple them on these omponents. Updte the new ertifites on the mngement omponents in the Consolidted SDDC to mintin the trusted onnetion. VMwre, In. 34

35 Certifite Replement 1 Reple the vrelize Automtion Certifite in Consolidted SDDC Reple the existing ertfite for ll vrelize Automtion servies from the vrelize Automtion Mngement Console. You reple the ertifite on the vrelize Automtion Appline, IS We server nd IS Mnger server to mintin trusted ommunition etween the vrelize Automtion nodes. 2 Updte the vrelize Automtion Certifite on vrelize Business for Consolidted SDDC After you updte the ertifite on the vrelize Automtion Appline nd IS omponents, reonnet vrelize Business to vrelize Automtion to instll the new ertifite nd re-estlish the trusted onnetion. 3 Updte the vrelize Automtion Certifite on vrelize Opertions Mnger for Consolidted SDDC After you hnge the ertifite of the vrelize Automtion Appline nd IS omponents, updte the ertifite on vrelize Opertions Mnger to keep the ommunition trusted y reonneting the vrelize Automtion Adpter. 4 Reple the SSL Certifite of vrelize Business Server for Consolidted SDDC Reple the existing SSL ertifite of vrelize Business with new one using the vrelize Business ppline mngement onsole. This ertifite is used when you ess the We interfe of the vrelize Business server. Reple the vrelize Automtion Certifite in Consolidted SDDC Reple the existing ertfite for ll vrelize Automtion servies from the vrelize Automtion Mngement Console. You reple the ertifite on the vrelize Automtion Appline, IS We server nd IS Mnger server to mintin trusted ommunition etween the vrelize Automtion nodes. 1 Log in to the vrelize Automtion ppline mngement onsole. Open We Browser nd go to Log in using the following redentils. User nme Pssword Vlue root vr_ppa_root_pssword 2 On vra s t, lik the Host s t. 3 Under SSL Configurtion, selet Import next to Certifite Ation. VMwre, In. 35

36 Certifite Replement 4 From text editor on the Windows host where you run the CertGenVVD utility, opy the ontent of the following ertifite files nd pste it in the orresponding text oxes in the user interfe, nd lik Sve s. Soure Content vr-for-1-pod.key vr-for-1-pod.3.pem Pssphrse tht you optionlly entered t genertion Trget Text Box RSA Privte Key Certifite Chin Pssphrse 5 Sroll down on the pge nd verify tht ll luster nodes hve een suessfully updted. 6 Clik the Certifites t nd use the following proedure to onfigure IS We server with the new ertifite first nd repet the following proedure gin with IS Mnger Servie. 7 Selet IS We next to Component Type IS Component IS We server IS Mnger Servie Component Type IS We Mnger Servie 8 Selet Import Certifite next to Certifite Ation VMwre, In. 36

37 Certifite Replement 9 From text editor on the Windows host where you run the CertGenVVD utility, opy the ontent of the following ertifite files nd pste it in the orresponding text oxes in the user interfe, nd lik Sve s. Soure Content vr-for-1-pod.key vr-for-1-pod.3.pem Pssphrse tht you optionlly entered t genertion Trget Text Box RSA Privte Key Certifite Chin Pssphrse VMwre, In. 37