赞
踩
博文主要描述了在 vCenter Server 8 上通过实用工具 certificate-manager 将 vSphere 默认 Machine SSL 证书替换为 企业 CA 自签名证书。适用的 vSphere 版本为 vSphere 7.0.x 和 vSphere 8.0.x
SSH 到 VCSA 中,cd 到 /root/machine_ssl 目录,此时该目录存在4个文件
需要用到的是
再次使用certificate-manager工具替换默认证书
root@vc7-3 [ ~ ]# /usr/lib/vmware-vmca/bin/certificate-manager
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 8.0 Certificate Manager *** |
| |
| -- Select Operation -- |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| NOTE: Solution user certs will be deprecated in a future |
| release of vCenter. Refer to release notes for more details.|
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 1
Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:
1. Generate Certificate Signing Request(s) and Key(s) for Machine SSL certificate
2. Import custom certificate(s) and key(s) to replace existing Machine SSL certificate
Option [1 or 2]: 2
Please provide valid custom certificate for Machine SSL.
File : /root/machine_ssl/machine_ssl.cer
Please provide valid custom key for Machine SSL.
File : /root/machine_ssl/vmca_issued_key.key
Please provide the signing certificate of the Machine SSL certificate
File : /root/machine_ssl/root-64.cer
You are going to replace Machine SSL cert using custom cert
Continue operation : Option[Y/N] ? : Y
Command Output: /root/machine_ssl/machine_ssl.cer: OK
Status : 100% Completed [All tasks completed successfully]
此时 SSL 证书的更新状态是100%成功完成。
登录 vSphere Client,Menu > Administration > Certificastes > Certificate Management,找到 Machine SSL Certificate,点击VIEW DETAILS
此时 企业CA 直接签发的 Machine SSL 证书替换成功。
我们替换的是 Machine SSL 证书,其它 VMCA 证书还是使用 vSphere 默认证书。
查看 VMware Certificate Authority 的 VMCA_ROOT_CERT 详细信息,显示内容依然和VMware相关:
1.企业 CA 签名证书替换 vSphere Machine SSL 证书Ⅰ—— 生成 CSR
2.企业 CA 签名证书替换 vSphere Machine SSL 证书Ⅱ—— 创建和添加证书模板
3.企业 CA 签名证书替换 vSphere Machine SSL 证书Ⅲ—— 颁发自签名与替换证书
4.[企业 CA 签名证书替换 vSphere Machine SSL 证书Ⅳ—— 替换默认证书](
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。