I am rebuilding one of my vCenter installations at the moment to split out all the subcomponents (SRM/VUM etc) in to separate VMs for scaling. One of the actions for this project was to integrate all components with our internal CA.

After reading VMware’s own document on the subject and Derek Seaman’s blog on the subject, I gave it a go.

First thing’s first, download OpenSSL from here. You will need to install the Visual C++ Redistributables first and then OpenSSL Light install. By default, this will install to C:\OpenSSL.

Within C:\OpenSSL\bin, create a file called openssl.cnf

[ req ]
default_bits = 1024
default_keyfile = rui.key
distinguished_name = req_distinguished_name
#Don’t encrypt the key
encrypt_key = no
prompt = no
string_mask = nombstr
[ req_distinguished_name ]
countryName = US
stateOrProvinceName = California
localityName = Palo Alto
0.organizationName = VMware, Inc.
emailAddress = ssl-certificates@vmware.com
commonName = vCenter.domain.local
subjectAltName = vCenter

(where vCenter.domain.local is the FQDN of your vCenter server and vCenter is the hostname)

Open command prompt, browse to a directory in which you want to save the files temporarily and create a certificate request by typing the following:

c:\openssl\bin\openssl.exe req -new -nodes -out rui.csr –config c:\openssl\bin\openssl.cnf

rui.key and rui.csr will be created within your temp directory. Open rui.csr with notepad and copy the text. This text will be used to request the certificate from your CA.

Open a browser, point it to your CA and select ‘Request a certificate’ then ‘Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file…’.

Paste the contents of rui.csr in to the Saved Request window and ensure the certificate template is set to Web Server (this template must support a minimum key size of 1024 or less!). In the additional attributes field, enter the following:

san:dns=vCenter.domain.local&dns=vCenter

(where vCenter.domain.local is the FQDN of your vCenter server and vCenter is the hostname)

Submit this then download the certificate (not the chain) with Base64 encoding. Save it in your temporary folder as rui.crt. Run the following command:

c:\openssl\bin\openssl.exe pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx

Within your temp folder, you should have the following files.

Stop the VMware VirtualCenter Server Service and browse to your VMware vCenter SSL certificate folder (by default – C:\Users\All Users\VMware\VMware VirtualCenter\SSL in Server 2008 and C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL in Server 2003). Back up all the files in this directory to somewhere safe.

Finally, copy rui.crt, rui.pfx and rui.key from your temporary location to the VMware SSL folder. Following this, from the VMware vCenter installation direction (in my case c:\Program Files (x86)\VMware\Infrastructure\VirtualCenter Server), run vpxd.exe –p. This prompts you to reset your DSN password to the vCenter database based on the new certs, if you don’t do this step, the service won’t start. Restart the VMware VirtualCenter Server service. As long as the certificates are correct, the service should start. If it doesn’t, check the log files for further info and at worst case, roll back your certificates.

From a client with your root cert installed, browse to your vCenter server from your browser, you should receive no certificate errors using either the FQDN or the hostname. To further test it’s working, log on with the vCenter client – you should get no more annoying certificate errors!

Next up is SRM, VUM and ESXi certificate configuration.