Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme

Transcription

1 SER2936BU vsphere SSL Certificates for Mere Mortals Adam VCIX6-DCV Sr. Technical Marketing Architect #VMworld #SER2936BU

2 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. CONFIDENTIAL 2

3 3

4 Certificate Lifecycle Management VMware Certificate Authority VMCA Located on: Embedded Deployment and Platform Services Controller VMware Endpoint Certificate Store VECS Located on: Embedded Deployment and vcenter Server Node 4

5 VMware Endpoint Certificate Store (VECS) VMCA Certificate Signed Machine SSL Certificate VMCA VECS 5

6 VMware Endpoint Certificate Store (VECS) Repository for Certificates and Private Keys Mandatory Component Key Stores: Machine SSL Certificates Trusted Roots Solution Users Certificates Generally managed via Certificate Manager vecs-cli available for more advanced operations or automation Does Not Manage Single Sign-On Certificates 6

7 VMware vsphere 6.x Certificate Types Machine SSL Certificate ESXi Certificates Solution User Certificates Single Sign-On Certificates 7

8 ESXi Certificates Post-install, ESXi always has an auto-generated certificate VMCA will provision a signed certificate when host is joined to vcenter (default mode) Custom certificates can be use if desired (custom mode) ESXi certificates are stored locally on each host in the /etc/vmware/ssl VMCA issued certificates can be renewed via the vsphere Client or PowerCLI

9 ESXi Certificates Example: function refreshcerts { process { } $hostid = Get-VMHost $vmhost Get-View $hostparam = New-Object VMware.Vim.ManagedObjectReference[] (1) $hostparam[0] = New-Object VMware.Vim.ManagedObjectReference $hostparam[0].value = $hostid.moref.value $hostparam[0].type = 'HostSystem' $_this = Get-View -Id 'CertificateManager-certificateManager' $_this.certmgrrefreshcertificates_task($hostparam) } 9

10 Machine SSL Certificates Server verification and secure communication e.g. HTTPS or LDAPS Each node has its own Machine SSL Certificate. i.e. Embedded Deployment; vcenter Server; or Platform Services Controller All services communicate through the reverse proxy Traffic does not go to the services themselves e.g. The vpxd service uses the MACHINE_SSL_CERT to expose its endpoint. 10

11 Certificate Replacement Options for vcenter VMCA Default VMCA provides the Root certificate All vsphere certificates chain to VMCA Regenerate certificates on demand easily Recommended VMCA Enterprise Replace VMCA CA cert with a subordinate CA certificate from the Enterprise PKI Upon removal of the old VMCA CA certificate, all old certificates will be regenerated Custom Disable VMCA as CA Provision custom certificates for each solution user and endpoint More complicated For highly security conscious customers only Hybrid Replacement of the Machine_SSL certs VMCA for Hosts and Solution Users Very popular with high security customers Recommended 11

12 VMware vsphere 6.x Certificate Manager Appliance Deployment /usr/lib/vmware-vmca/ bin/certificate-manager Windows Deployment <Drive>:\Program Files\VMware\ vcenter Server\vmcad\ certificate-manager 12

13 Common Certificate Manager Use Cases VMworld 2017 Content: Not for VMCA as Root CA (Default or Option 4) Custom CA (Option 1 & 5) VMCA as Enterprise CA Subordinate publication (Option 2) Hybrid (Option 1) 13

14 Demo: VMCA as Root CA (Default)

15 Full Custom (No VMCA) Essentially bypass VMCA Generate a CSR & Certificate for each: Machine SSL Solution User ESX Host Manual installation and renewal Most secure (highly regulated / secure environments) Most amount of work 15

16 VMCA as Enterprise CA Subordinate Does NOT support wildcard cards or SubjectAltName You CANNOT create subsidiary CAs of VMCA No explicit limit to the length of the certificate chain Synchronize time for all nodes in environment 16

17 Hybrid Approach Concepts Security Custom certificates for the Web Client VMworld 2017 Operations VMCA for everything else (User Solutions, ESX hosts) Content: Not for publication 17

18 Hybrid Mode: 3 rd Party Cert for Client access What many security concerned companies are using for their vsphere environments 3 rd Party Certificate Authority DC1.lab.local vcenter Server VCSA SSL Certificate issued by DC1.lab.local Certificate Authority SSL Certificate issued by vcsa.lab.local VMCA 18

19 Implementing Hybrid Mode (High Level) VMworld 2017 Content: Not for 1. Use Option 1 to: Replace Machine_SSL cert on all PSCs in SSO Domain Replace Machine_SSL cert on all vcenter Servers in SSO domain publication 2. Use vsphere Client / PowerCLI to replace certs on ESX hosts 19

20 Let s Compare!

21 Example Environment 6 vcenter Servers 2 Sites 50 Hosts per vcenter Server 300 Hosts total Approach SubCAs Machine SSL VMworld 2017 Content: Not for publication Solution Users ESXi Hosts Total Certificates Subordinate CA Full Custom N/A Hybrid N/A

22 Walkthrough Step-by-step available at Accompanying blog post at VMworld 2017 Content: Not for publication

23 CONFIDENTIAL 23

24 vsphere Central vspherecentral.vmware.com Curated repository of vsphere resources including blogs, KBs, videos, and walkthroughs Simple to access and a single URL to remember Conveniently export resources to PDF for offline viewing VMworld 2017 Content: Not for publication 2017 VMware Inc. All rights reserved.

25 vsphere 6.5 Topology & Upgrade Planning Tool vspherecentral.vmware.com/path-finder Guided walkthrough to assist in making critical topology and upgrade decisions Provides steps, diagram, and important resources for planning, execution, and post-upgrade VMworld 2017 Content: Not for publication 2017 VMware Inc. All rights reserved.

26

27 #migrate2vcsa