How to replace VMware ESXi 6. SSL certificate - logo

Certificates are very common in our daily life. Starting from logging to your banking account, checking email or simply visiting social media, we use secure communication. One of ingredients of it are certificates. I will not describe you in details how do we use them – if you are reading this most likely you know what you are doing.

Today blog post How to replace VMware ESXi 6.* SSL certificate will describe you how to replace SSL certificates on ESXi hosts.

Prerequisites

First of all you need ESXi host, certificate authority and few minutes to replace certificates.To generate SSL certificate for your ESXi host you need OpenSSL version 0.9.8 installed on your local system or tool called XCA. In VMware documentation all certificate signing requests are done using OpenSSL but I will show you how to do it in faster and more efficient way with XCA.

How to replace VMware ESXi 6.* SSL certificate

Procedure of replacing ESXi certificate is not complex one, but if you want to replace more certificates in your environment some things have to be prepared first to make procedure smooth.

Generate certificate signing request (CSR)

One of the first steps in certificate replacement is to correctly identify settings which certificate has to have. If some certain parameters will not be included or configured, either certificate replacement will fail or you might encounter more serious problems in your environment.

Certificate template

I am using fantastic tool called XCA to store certificate template, certificates, private keys and certificate signing requests. First step to replace ESXi SSL certificate is to create template.

  1. Download XCA from SourceForge XCA download page for your platform.
  2. Once installed start XCA and create new database.
    How to replace VMware ESXi 6. SSL certificate - 1
  3. Enter the name for the new database and select desired location.
    How to replace VMware ESXi 6. SSL certificate - 2
  4. Enter password to your database.
    How to replace VMware ESXi 6. SSL certificate - 3
  5. Database was successfully created. We will create new template for our ESXi hosts. In XCA switch to templates tab and click New template.
    How to replace VMware ESXi 6. SSL certificate - 4
  6. We are asked now what preset templates values we should import. Select Nothing.
    How to replace VMware ESXi 6. SSL certificate - 5
  7. Fill Subject section with following values.
    How to replace VMware ESXi 6. SSL certificate - 6
  8. Switch to Extensions tab. Fill X509v3 Subject Alternative Name with ESXi FQDN and IP address.
    How to replace VMware ESXi 6. SSL certificate - 7
  9. Switch to Key Usage tab and select displayed values.
    How to replace VMware ESXi 6. SSL certificate - 8
  10. This are all settings we need to successfully generate certificate signing requests.

Certificate signing request

Once our preparation with certificates is done we can initiate certificate signing requests.

  1. To generate certificate signing request select template we just created and click Create request.
    How to replace VMware ESXi 6. SSL certificate - 9
  2. Switch to Subject tab and enter Internal name – this is just name displayed internally in XCA. Change as well commonName field to match new server name. Once field 1 and 2 are filled click on field 3 Generate a new key.
    How to replace VMware ESXi 6. SSL certificate - 10
  3. We have to generate private key which we will upload to ESXI host and it will be validated with certificate we will get from this certificate signing request. Type Name matching Internal name to easily correlate private key and certificate.
    How to replace VMware ESXi 6. SSL certificate - 11
  4. Private key was successfully created.
    How to replace VMware ESXi 6. SSL certificate - 12
  5. Click OK and you will see confirmation that we successfully created certificate signing request for our ESXi host.
    How to replace VMware ESXi 6. SSL certificate - 13

Generate certificate

  1. Last step to receive certificate is to export it from XCA. Switch to Certificate Signing Request tab and select friendly name you have choose for your ESXi. In my case it is ESXi03.wojcieh.local. Click Export. We simply use PEM format to export CSR.
    How to replace VMware ESXi 6. SSL certificate - 14
  2. Once we exported certificate we need to request certificate with our Certificate Authority. In my case it is Certificate Authority installed on Microsoft Windows Server 2012 R2. Navigate to CA https://FQDN/certsrv. Click Request a certificate link.
    How to replace VMware ESXi 6. SSL certificate - 15
  3. Choose advanced certificate request.
    How to replace VMware ESXi 6. SSL certificate - 16
  4. Click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
    How to replace VMware ESXi 6. SSL certificate - 17
  5. Open with any editor previously saved CSR and paste it to CA, select previously created vSphere certificate template and click Submit.
    How to replace VMware ESXi 6. SSL certificate - 18
  6. Depending of you certificate authority configuration you will receive certificate immediately or certificate will have to be approved. In my case since I am in lab environment, certificate was immediately approved and ready to download. Select Base 64 encoded and click Download certificate.
    How to replace VMware ESXi 6. SSL certificate - 19
  7. Export private key from XCA. Switch to Select ESXi host and
    How to replace VMware ESXi 6. SSL certificate - 23

Replace certificate on ESXi host

We are nearly at the end of the of the process of replacing SSL Certificate on ESXi 6.*. We will simply follow VMware Knowledge Base Article: Configuring CA signed certificates for ESXi 6.0 hosts.

  1. Login to vCenter Server.
  2. Enter maintenance mode on ESXi server we will replace certificates on.
    How to replace VMware ESXi 6. SSL certificate - 20
  3. In my case I have vSAN working in this cluster and this is why have additional question about data availability. I selected No data migration, because I don’t have any virtual machines running in that cluster.
    How to replace VMware ESXi 6. SSL certificate - 21
  4. Start SSH service on ESXi.
    How to replace VMware ESXi 6. SSL certificate - 22
  5. Upload private key and certificate for your ESXi to local datastore or upload it via SCP protocol.
    How to replace VMware ESXi 6. SSL certificate - 24
  6. As you see on the screen I have two filenames. Rename certificate to rui.crt and private key file to rui.key.
    How to replace VMware ESXi 6. SSL certificate - 25
  7. No we will move old certificates from /etc/vmware/ssl to local datastore.
    How to replace VMware ESXi 6. SSL certificate - 26
  8. Now we will move CA signed certificates to /etc/vmware/ssl directory.
    How to replace VMware ESXi 6. SSL certificate - 27
  9. Once certificates are replaced we just need to restart management agents. Simply type services.sh restart. As you see below certificate was successfully replaced.
    How to replace VMware ESXi 6. SSL certificate - 28

 Summary

As you see procedure to replace ESXi 6.0 SSL Certificates is not that complex. More time you spend prepairing template, receive certificate or upload it to ESXi.

Rate this post
Wojciech Marusiak
Social Media

Wojciech Marusiak

Consultant at VMware Global, Inc.
I am innovative and experienced VMware and Windows Server Engineer with over 10 years in the IT industry specializing in VMware virtualization and Microsoft Server environment.

My experience and skills has been proven by leading vendor certifications like VMware Certified Advanced Professional 5 – Data Center Administration, VMware Certified Advanced Professional 5 – Data Center Design, VMware Certified Professional 6 - Data Center Virtualization, VMware Certified Professional 6 - Network Virtualization, Microsoft MCITP Server Administrator, ITIL V3, VMware vExpert 2014, 2015, 2016 and 2017 Award.

My blog wojcieh.net - was voted #50 in TopvBlog 2016 contest!
Wojciech Marusiak
Social Media