Certificate Replacement. 13 FEB 2018 VMware Validated Design 4.2 VMware Validated Design for Software-Defined Data Center 4.2

Transcription

1 Certifite Replement 13 FEB 2018 VMwre Vlidted Design 4.2 VMwre Vlidted Design for Softwre-Defined Dt Center 4.2

2 Certifite Replement You n find the most up-to-dte tehnil doumenttion on the VMwre wesite t: If you hve omments out this doumenttion, sumit your feedk to dofeedk@vmwre.om VMwre, In Hillview Ave. Plo Alto, CA Copyright VMwre, In. All rights reserved. Copyright nd trdemrk informtion. VMwre, In. 2

3 Contents Aout VMwre Vlidted Design Certifite Replement 5 1 Region A Certifite Replement 6 Crete nd Add Mirosoft Certifite Authority Templte 7 Generte MSCA-Signed Certifites for the SDDC Mngement Components in Region A 8 Generte Certifite Signing Requests nd Certifites from Third-Prty CA in Region A 11 Reple Certifites of the Virtul Infrstruture Components in Region A 15 Reple the Pltform Servies Controller Certifites in Region A 16 Reple the vcenter Server Certifites in Region A 21 Reple the ESXi Host Certifites in Region A 31 Reple the NSX Mnger Certifites in Region A 36 Reple Certifites of the Opertions Mngement Components in Region A 41 Reple vrelize Opertions Mnger Certifite in Region A 41 Reple the Certifite of vrelize Log Insight in Region A 42 Updte the SSL Certifite for Event Forwrding to Region B 43 Reple Certifites of the Cloud Mngement Pltform Components in Region A 45 Reple the vrelize Automtion Certifite in Region A 46 Updte the vrelize Automtion Certifite on vrelize Orhestrtor nd vrelize Business in Region A 47 Updte the vrelize Automtion Certifite on vrelize Opertions Mnger in Region A 49 Reple the SSL Certifite on vrelize Business Server in Region A 49 Reple Certifites of the Business Continuity Components in Region A 50 Reple the Site Reovery Mnger Certifite in Region A 51 Reple the CA-Signed Certifite on vsphere Replition in Region A 52 2 Region B Certifite Replement 54 Crete nd Add Mirosoft Certifite Authority Templte in Region B 55 Generte MSCA-Signed Certifites for the SDDC Mngement Components in Region B 56 Use the Certifite Genertion Tool to Generte Certifite Signing Requests in Region B 59 Reple Certifites of the Virtul Infrstruture Components in Region B 61 Reple the Pltform Servies Controller Certifites in Region B 62 Reple vcenter Server Certifites in Region B 67 Reple the ESXi Host Certifites in Region B 77 Reple the NSX Mnger Certifites in Region B 82 Reple Certifites of the Opertions Mngement Components in Region B 87 Reple the Certifite to vrelize Log Insight in Region B 87 Updte the SSL Certifite for Event Forwrding to Region A 88 VMwre, In. 3

4 Certifite Replement Reple Certifites of the Business Continuity Components in Region B 90 Reple the VMwre Site Reovery Mnger Certifites 90 Reple the CA-Signed Certifite on vsphere Replition in Region B 92 VMwre, In. 4

5 Aout VMwre Vlidted Design Certifite Replement VMwre Vlidted Design Certifite Replement provides step-y-step instrutions out repling ertifites on ll mngement omponents of running Softwre-Defined Dt Center (SDDC) whose design follows this VMwre Vlidted Design for Softwre-Defined Dt Center. In n SDDC, the seurity of the environment depends on the vlidity nd trust of the mngement ertifites. As est prtie, you reple mngement ertifites in the following ses: Before ertifites expire When ertifite is ompromised. When the ttriutes relted to ertifite hnge, for exmple, the host nme or orgniztion nme. The ertifite replement proess onsists of the following phses: 1 Otin ertifites for the mngement omponents tht re signed y ustom ertifite uthority (CA) Use the VMwre Vlidted Design Certifite Genertion utility to utomtilly generte the ertifites for ll omponents. Mnully generte Certifite Signing Requests (CSRs) nd request CA-signed ertifites providing the CSRs to the CA. 2 Reple the ertifites in the live SDDC environment. Intended Audiene The VMwre Vlidted Design Certifite Replement doumenttion is intended for loud rhitets, infrstruture dministrtors, loud dministrtors nd loud opertors who re fmilir with nd wnt to use VMwre softwre to deploy in short time nd mnge n SDDC tht meets the requirements for pity, slility, kup nd restore, nd disster reovery. Required Softwre VMwre Vlidted Design Certifite Replement is omplint nd vlidted with ertin produt versions. See VMwre Vlidted Design Relese Notes for more informtion out supported produt versions. VMwre, In. 5

6 Region A Certifite 1 Replement Crete nd Add Mirosoft Certifite Authority Templte The first step in ertifite genertion nd replement is setting up Mirosoft Certifite Authority templte on the Ative Diretory (AD) servers for the region. The templte ontins the ertifite uthority (CA) ttriutes for signing ertifites of VMwre SDDC solutions. After you hve reted the new templte, you dd it to the ertifite templtes of the Mirosoft CA. Generte MSCA-Signed Certifites for the SDDC Mngement Components in Region A Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifites tht re signed y the Mirosoft ertifite uthority (MSCA) for ll mngement produts with single opertion. Generte Certifite Signing Requests nd Certifites from Third-Prty CA in Region A Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifite signing request (CSR) files tht you n send to third-prty ertifite uthority nd reeive CAsigned ertifites for the mngement omponents. Reple Certifites of the Virtul Infrstruture Components in Region A In this design, you reple user-fing ertifites with ertifites tht re signed y Mirosoft Certifite Authority (CA). If the CA-signed ertifites of the mngement omponents expire fter you deploy the SDDC, you must reple them individully on eh ffeted omponent. Reple Certifites of the Opertions Mngement Components in Region A If the ertifite of vrelize Opertions Mnger or vrelize Log Insight expires, reple it nd updte it on the mngement omponents in the region to mintin seure onnetion. Reple Certifites of the Cloud Mngement Pltform Components in Region A After you generte signed ertifites for the Cloud Mngement Pltform, reple them nd updte them on the mngement omponents in the region to mintin seure onnetion. Reple Certifites of the Business Continuity Components in Region A In dul-region environment, fter you generte signed ertifites for Site Reovery Mnger nd vsphere Replition, reple them nd updte them on the onneted mngement omponents in the region to mintin seure onnetion. VMwre, In. 6

7 Certifite Replement Crete nd Add Mirosoft Certifite Authority Templte The first step in ertifite genertion nd replement is setting up Mirosoft Certifite Authority templte on the Ative Diretory (AD) servers for the region. The templte ontins the ertifite uthority (CA) ttriutes for signing ertifites of VMwre SDDC solutions. After you hve reted the new templte, you dd it to the ertifite templtes of the Mirosoft CA. Creting ertifite uthority templte for this VMwre Vlidted Design inludes the following opertions: 1 Set up Mirosoft Certifite Authority templte. 2 Add the new templte to the ertifite templtes of the Mirosoft CA. Prerequisites This VMwre Vlidted Design sets the Certifite Authority servie hierrhies on oth Ative Diretory (AD) servers: the min domin d01rpl.rinpole.lol (root CA) nd the sudomin d01sfo.sfo01.rinpole.lol (the intermedite CA). Verify tht you instlled Mirosoft Server 2012 R2 VM with Ative Diretory Domin Servies enled. Verify tht the Certifite Authority Servie role nd the Certifite Authority We Enrollment role is instlled nd onfigured on the Ative Diretory Server. Verify tht d01sfo.sfo01.rinpole.lol hs een set up to e the intermedite CA of the root CA d01rpl.rinpole.lol. Use hshing lgorithm of SHA-256 or higher on the ertifite uthority. 1 Log in to the following AD server y using Remote Desktop Protool (RDP) lient. Vlue FQDN If you use the intermedite CA, onnet to d01sfo.sfo01.rinpole.lol. User nme Pssword Ative Diretory dministrtor d_dmin_pssword 2 Clik Windows Strt > Run, enter erttmpl.ms, nd lik OK. 3 In the Certifite Templte Console, under Templte Disply Nme, right-lik We Server nd lik Duplite Templte. 4 In the Duplite Templte window, leve Windows Server 2003 Enterprise seleted for kwrd omptiility nd lik OK. 5 In the Properties of New Templte dilog ox, lik the Generl t. 6 In the Templte disply nme text ox, enter VMwre s the nme of the new templte. VMwre, In. 7

8 Certifite Replement 7 Clik the Extensions t nd speify extensions informtion. d e f Selet Applition Poliies nd lik Edit. Selet Server Authentition, lik Remove, nd lik OK. Selet Key Usge nd lik Edit. Selet the Signture is proof of origin (nonrepudition) hek ox. Leve the defult for ll other options. Clik OK. 8 Clik the Sujet Nme t, ensure tht the Supply in the request option is seleted, nd lik OK to sve the templte. 9 To dd the new templte to your CA, lik Windows Strt > Run, enter ertsrv.ms, nd lik OK. 10 In the Certifition Authority window, expnd the left pne if it is ollpsed. 11 Right-lik Certifite Templtes nd selet New > Certifite Templte to Issue. 12 In the Nme olumn of the Enle Certifite Templtes dilog ox, selet the VMwre ertifite tht you hve just reted nd lik OK. Generte MSCA-Signed Certifites for the SDDC Mngement Components in Region A Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifites tht re signed y the Mirosoft ertifite uthority (MSCA) for ll mngement produts with single opertion. For informtion out the VMwre Vlidted Design Certifite Genertion Utility, see VMwre Knowledge Bse rtile nd VMwre Vlidted Design Plnning nd Preprtion. Prerequisites Provide Window Server 2012 host tht is prt of the sfo01.rinpole.lol domin. Instll n intermedite Certifite Authority server on the sfo01.rinpole.lol domin. 1 Log in to Windows host tht hs ess to your dt enter. 2 Downlod the CertGenVVD-version.zip file of the Certifite Genertion Utility from VMwre Knowledge Bse rtile on the Windows host where you onnet to the dt enter nd extrt the ZIP file to the C: drive. 3 In the C:\CertGenVVD-version folder, open the defult.txt file in text editor. VMwre, In. 8

9 Certifite Replement 4 Verify tht the following properties re onfigured. ORG=Rinpole In. OU=Rinpole.lol LOC=SFO ST=CA CC=US CN=VMwre_VVD keysize= Verify tht the C:\CertGenVVD-version\ConfigFiles folder ontins only the following files. Tle 1 1. Certifite Genertion Files for Region A Host Nme or Servie in Region A Configurtion Files Virtul Infrstruture Lyer Pltform Servies Controller sfo01ps01.sfo01.rinpole.lol sfo01m01ps01.sfo01.rinpole.lol sfo01ps01.txt sfo01w01ps01.sfo01.rinpole.lol vcenter Server sfo01m01v01.sfo01.rinpole.lol sfo01m01v01.txt sfo01w01v01.sfo01.rinpole.lol sfo01w01v01.txt ESXi Hosts sfo01m01esx01.sfo01.rinpole.lol sfo01m01esx01.txt sfo01m01esx02.sfo01.rinpole.lol sfo01m01esx03.sfo01.rinpole.lol sfo01m01esx04.sfo01.rinpole.lol sfo01w01esx01.sfo01.rinpole.lol sfo01w01esx02.sfo01.rinpole.lol sfo01w01esx03.sfo01.rinpole.lol sfo01w01esx04.sfo01.rinpole.lol sfo01m01esx02.txt sfo01m01esx03.txt sfo01m01esx04.txt sfo01w01esx01.txt sfo01w01esx02.txt sfo01w01esx03.txt sfo01w01esx04.txt NSX Mnger sfo01m01nsx01.sfo01.rinpole.lol sfo01m01nsx01.txt Site Reovery Mnger nd vsphere Replition Cloud Mngement Pltform Lyer sfo01w01nsx01.sfo01.rinpole.lol sfo01m01srm01.sfo01.rinpole.lol sfo01m01vrms01.sfo01.rinpole.lol sfo01w01nsx01.txt sfo01m01srm01.txt sfo01m01vrms01.txt VMwre, In. 9

10 Certifite Replement Tle 1 1. Certifite Genertion Files for Region A (Continued) Host Nme or Servie in Region A vrelize Automtion vr01svr01.rinpole.lol vr01svr01.rinpole.lol vr01svr01.rinpole.lol vr01iws01.rinpole.lol vr01iws01.rinpole.lol vr01iws01.rinpole.lol vr01ims01.rinpole.lol vr01ims01.rinpole.lol vr01ims01.rinpole.lol vr01dem01.rinpole.lol vr01dem01.rinpole.lol Configurtion Files vr.txt vrelize Business Server vr01svr01.rinpole.lol vr.txt Opertions Mngement Lyer vrelize Opertions Mnger vrops01svr01.rinpole.lol vrops01svr01.rinpole.lol vrops01svr01.rinpole.lol vrops01svr01.rinpole.lol vrelize Log Insight sfo01vrli01.sfo01.rinpole.lol sfo01vrli01.sfo01.rinpole.lol sfo01vrli01.sfo01.rinpole.lol sfo01vrli01.sfo01.rinpole.lol vrops.txt vrli.sfo01.txt 6 Verify tht eh onfigurtion file inludes FQDNs nd host nmes in the dedited setions. For exmple, the onfigurtion files for the Pltform Servie Controller instnes must ontin the following properties: sfo01ps01.txt [CERT] NAME=defult ORG=defult OU=defult LOC=SFO ST=defult CC=defult CN=sfo01ps01.sfo01.rinpole.lol keysize=defult [SAN] sfo01ps01 sfo01m01ps01 sfo01w01ps01 sfo01ps01.sfo01.rinpole.lol sfo01m01ps01.sfo01.rinpole.lol sfo01w01ps01.sfo01.rinpole.lol VMwre, In. 10

11 Certifite Replement 7 Open Windows PowerShell prompt nd nvigte to the CertGenVVD folder. d C:\CertGenVVD-version 8 Grnt permissions to run third-prty PowerShell sripts. Set-ExeutionPoliy Unrestrited 9 Vlidte if you n run the utility using the onfigurtion on the host nd verify if VMwre is inluded in the printed CA templte poliy..\certgenvvd-version.ps1 -vlidte 10 Generte MSCA-signed ertifites..\certgenvvd-version.ps1 -MSCASigned -ttri 'CertifiteTemplte:VMwre' -inter 11 In the C:\CertGenVVD-version folder, verify tht the utility reted the SignedByMSCACerts sufolder. 12 In C:\CertGenVVD-version\SignedByMSCACerts\Root64 su folder, renme hinroot64.er to Root64.er. Wht to do next Reple the produt ertifites with the ertifites tht the CertGenVVD utility hs generted. See Reple Certifites of the Virtul Infrstruture Components in Region A, Reple Certifites of the Opertions Mngement Components in Region A nd Reple Certifites of the Cloud Mngement Pltform Components in Region A. Generte Certifite Signing Requests nd Certifites from Third-Prty CA in Region A Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifite signing request (CSR) files tht you n send to third-prty ertifite uthority nd reeive CA-signed ertifites for the mngement omponents. Prerequisites Provide Windows Server 2012 host tht is tht hs ess to your dt enter. 1 Log in to Windows host tht hs ess to your dt enter. 2 Downlod the CertGenVVD-version.zip file of the Certifite Genertion Utility from VMwre Knowledge Bse rtile on the Windows host where you onnet to the dt enter nd extrt the ZIP file to the C: drive. 3 In the C:\CertGenVVD-version folder, open the defult.txt file in text editor. VMwre, In. 11

12 Certifite Replement 4 Verify tht following properties re onfigured. ORG=Rinpole In. OU=Rinpole.lol LOC=SFO ST=CA CC=US CN=VMwre_VVD keysize= Verify tht only the C:\CertGenVVD-version\ConfigFiles folder ontins only following files. Tle 1 2. Certifite Genertion Files for Region A Host Nme or Servie in Region A Configurtion Files Virtul Infrstruture Lyer Pltform Servies Controller sfo01ps01.sfo01.rinpole.lol sfo01m01ps01.sfo01.rinpole.lol sfo01ps01.txt sfo01w01ps01.sfo01.rinpole.lol vcenter Server sfo01m01v01.sfo01.rinpole.lol sfo01m01v01.txt sfo01w01v01.sfo01.rinpole.lol sfo01w01v01.txt ESXi Hosts sfo01m01esx01.sfo01.rinpole.lol sfo01m01esx01.txt sfo01m01esx02.sfo01.rinpole.lol sfo01m01esx03.sfo01.rinpole.lol sfo01m01esx04.sfo01.rinpole.lol sfo01w01esx01.sfo01.rinpole.lol sfo01w01esx02.sfo01.rinpole.lol sfo01w01esx03.sfo01.rinpole.lol sfo01w01esx04.sfo01.rinpole.lol sfo01m01esx02.txt sfo01m01esx03.txt sfo01m01esx04.txt sfo01w01esx01.txt sfo01w01esx02.txt sfo01w01esx03.txt sfo01w01esx04.txt NSX Mnger sfo01m01nsx01.sfo01.rinpole.lol sfo01m01nsx01.txt Site Reovery Mnger nd vsphere Replition Cloud Mngement Pltform Lyer sfo01w01nsx01.sfo01.rinpole.lol sfo01m01srm01.sfo01.rinpole.lol sfo01m01vrms01.sfo01.rinpole.lol sfo01w01nsx01.txt sfo01m01srm01.txt sfo01m01vrms01.txt VMwre, In. 12

13 Certifite Replement Tle 1 2. Certifite Genertion Files for Region A (Continued) Host Nme or Servie in Region A vrelize Automtion vr01svr01.rinpole.lol vr01svr01.rinpole.lol Configurtion Files vr.txt vr01svr01.rinpole.lol vr01iws01.rinpole.lol vr01iws01.rinpole.lol vr01iws01.rinpole.lol vr01ims01.rinpole.lol vr01ims01.rinpole.lol vr01ims01.rinpole.lol vr01dem01.rinpole.lol vr01dem01.rinpole.lol vrelize Business Server vr01svr01.rinpole.lol vr.txt Opertions Mngement Lyer vrelize Opertions Mnger vrops01svr01.rinpole.lol vrops01svr01.rinpole.lol vrops.txt vrops01svr01.rinpole.lol vrops01svr01.rinpole.lol vrelize Log Insight sfo01vrli01.sfo01.rinpole.lol sfo01vrli01.sfo01.rinpole.lol vrli.sfo01.txt sfo01vrli01.sfo01.rinpole.lol sfo01vrli01.sfo01.rinpole.lol Business Continuity Site Reovery Mnger nd vsphere Replition sfo01m01srm01.sfo01.rinpole.lol sfo01m01vrms01.sfo01.rinpole.lol sfo01m01srm01.txt sfo01m01vrms01.txt 6 Verify tht eh onfigurtion file inludes FQDN nd host nmes in the dedited setions. For exmple, the onfigurtions files for the Pltform Servie Controller instnes must ontin the following properties: VMwre, In. 13

14 Certifite Replement sfo01ps01.txt [CERT] NAME=defult ORG=defult OU=defult LOC=SFO ST=defult CC=defult CN=sfo01ps01.sfo01.rinpole.lol keysize=defult [SAN] sfo01ps01 sfo01m01ps01 sfo01w01ps01 sfo01ps01.sfo01.rinpole.lol sfo01m01ps01.sfo01.rinpole.lol sfo01w01ps01.sfo01.rinpole.lol 7 Open Windows PowerShell prompt nd nvigte to the folder of the CertGenVVD utility. d C:\CertGenVVD-version 8 Grnt permissions to run third-prty PowerShell sripts. Set-ExeutionPoliy Unrestrited 9 Vlidte if you n run the utility using the onfigurtion on the host nd verify if VMwre is inluded in the printed CA templte poliy..\certgenvvd-version.ps1 -vlidte 10 Generte ertifite request files for the mngement omponents in the SDDC..\CertGenVVD-version.ps1 -CSR 11 Lote the CSR files in the C:\CertGenVVD-version\CSRCerts folder nd send it to the third-prty CA to request the signed ertifites. 12 After you otin ll the signed ertifite files nd the root CA ertifite, move the signed ertifite files k to eh diretory where the CSR files reside. 13 In ommnd prompt, nvigte to the folder tht ontins the CA root ertifite nd renme it to Root64.er. 14 If the ertifites re signed y multiple intermedite CAs, ontente the ertifites in one ertifite hin file y running the following ommnd. opy IntermediteCAroot01.er+IntermediteCAroot02.er+RootCA.er > Root64.er 15 Move the Root64.er to the C:\CertGenVVD-version\CSRCerts\Root64 folder. VMwre, In. 14

15 Certifite Replement 16 Run CertGenVVD tool with the -CSR nd -extr ommnd options to generte ll ertifites tht re required for the SDDC mngement omponents..\certgenvvd-version.ps1 CSR -extr Wht to do next Reple the produt ertifites with the ertifites tht the CertGenVVD utility hs generted. See Reple Certifites of the Virtul Infrstruture Components in Region A, Reple Certifites of the Opertions Mngement Components in Region A nd. Reple Certifites of the Virtul Infrstruture Components in Region A In this design, you reple user-fing ertifites with ertifites tht re signed y Mirosoft Certifite Authority (CA). If the CA-signed ertifites of the mngement omponents expire fter you deploy the SDDC, you must reple them individully on eh ffeted omponent. By defult, virtul infrstruture mngement omponents use TLS/SSL ertifites tht re signed y the VMwre Certifite Authority (VMCA). Infrstruture dministrtors onnet to different SDDC omponents, suh s vcenter Server systems or Pltform Servies Controller, from We rowser to perform onfigurtion, mngement nd trouleshooting. The uthentiity of the network node to whih the dministrtor onnets must e onfirmed with vlid TLS/SSL ertifite. You n use other ertifite uthorities ording to the requirements of your orgniztion. You do not reple ertifites for mhine-to-mhine ommunition. If neessry, you n mnully mrk these ertifites s trusted. 1 Reple the Pltform Servies Controller Certifites in Region A 2 Reple the vcenter Server Certifites in Region A Reple the ertifite on eh vcenter Server instne in Region A nd reonnet it to the other mngement omponents to updte the new ertifite on these omponents. 3 Reple the ESXi Host Certifites in Region A Reple the defult or expired ertifites on the ESXi hosts with ertifites tht re generted y using the CertGenVVD utility. 4 Reple the NSX Mnger Certifites in Region A Reple the ertifite on n NSX Mnger instne, for exmple, if it is out to expire, nd updte it on the mngement omponents onneted to this instne. VMwre, In. 15

16 Certifite Replement Reple the Pltform Servies Controller Certifites in Region A Reple the ertifites of the pir of Pltform Servies Controller instnes in Region A. Reonnet the Pltform Servies Controller pir to the vcenter Server nd NSX Mnger instnes to updte the ertifites for vcenter Single Sign-on on these omponents. 1 Diret Trffi to Compute Pltform Servies Controller in Region A Before you reple the ertifite of the Pltform Servies Controller pir in Region A, disle the Pltform Servies Controller for the mngement luster sfo01m01ps01 in the lod lner to route ll trffi to the Pltform Servies Controller for the mngement luster sfo01w01ps01. 2 Reple the Pltform Servies Controller Certifites in Region A To estlish trusted onnetion with the other SDDC mngement omponents, you reple the defult or expiring mhine SSL ertifite on eh Pltform Servies Controller instne in the region with ustom ertifite. The ertifite, tht is generted y the CertGenVVD utility, is signed y the ertifite uthority (CA) ville on the prent Ative Diretory (AD) server or on the intermedite Ative Diretory (AD) server. 3 Updte the Pltform Servies Controller Certifites on the Mngement Components in Region A After you reple the ertifite on а Pltform Servies Controller instne, updte the ertifite on the vcenter Server nd NSX Mnger instnes in the region. 4 Re-Enle Compute Pltform Servies Controller on the Lod Blner in Region A After you reple the ertifite on the Pltform Servies Controller instnes, re-lne trffi etween them. Wht to do next If you reple the ertifites of vcenter Server fter those of the Pltform Servies Controllers, see Reple the Certifite of the Mngement vcenter Server in Region A. Diret Trffi to Compute Pltform Servies Controller in Region A Before you reple the ertifite of the Pltform Servies Controller pir in Region A, disle the Pltform Servies Controller for the mngement luster sfo01m01ps01 in the lod lner to route ll trffi to the Pltform Servies Controller for the mngement luster sfo01w01ps01. VMwre, In. 16

17 Certifite Replement 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 2 From the Home menu of the vsphere We Client, selet Networking & Seurity. 3 In the Nvigtor, lik NSX Edges. 4 From the NSX Mnger drop-down menu, selet Doule-lik the sfo01ps01 edge devie to open its network settings. 6 On the Mnge t, lik the Lod Blner t nd lik Pools. 7 Selet pool-1 nd lik Edit. 8 Selet the sfo01m01ps01 memer, lik Edit, selet Disle from the Stte drop-down menu, nd lik OK. 9 Repet the proedure to disle sfo01m01ps01 in pool-2. Reple the Pltform Servies Controller Certifites in Region A To estlish trusted onnetion with the other SDDC mngement omponents, you reple the defult or expiring mhine SSL ertifite on eh Pltform Servies Controller instne in the region with ustom ertifite. The ertifite, tht is generted y the CertGenVVD utility, is signed y the ertifite uthority (CA) ville on the prent Ative Diretory (AD) server or on the intermedite Ative Diretory (AD) server. The mhine ertifite on oth Pltform Servies Controller instnes in the region must e the sme euse they re lod-lned ording to this vlidted design. The ertifite must hve ommon nme tht is equl to the lod-lned Fully Qulified Domin Nme (FQDN). Eh Pltform Servies Controller FQDN nd short nme, nd the lod-lned FQDN nd short nme must e in the Sujet Alternte Nme (SAN) of the generted ertifite. VMwre, In. 17

18 Certifite Replement Tle 1 3. Certifite-Relted Files on Pltform Servies Controller Instnes Pltform Servies Controller Certifite File Nme sfo01m01ps01.sfo01.rinpole.lol sfo01ps01.1.er sfo01ps01.key Root64.er sfo01w01ps01.sfo01.rinpole.lol sfo01ps01.1.er sfo01ps01.key Root64.er 1 Open Seure SHell onnetion to the Pltform Servies Controller virtul mhine. Open n SSH onnetion to sfo01m01ps01.sfo01.rinpole.lol. Log in using the following redentils. Usernme Pssword Vlue root ps_root_pssword 2 Chnge the Pltform Servies Controller ommnd shell to the Bsh shell to llow seure opy (sp) onnetions for the root user. shell hsh -s "/in/sh" root 3 Copy the generted ertifites to the Pltform Servies Controller. Run the following ommnd to rete new temporry folder. mkdir -p /root/erts Copy the ertifite files sfo01ps01.1.er, sfo01ps01.key nd Root64.er to the /root/erts folder. You n use n sp softwre like WinSCP. 4 Reple the ertifite on the Pltform Servies Controller. Strt the vsphere Certifite Mnger utility on the Pltform Servies Controller. /usr/li/vmwre-vm/in/ertifite-mnger Selet Option 1 (Reple Mhine SSL ertifite with Custom Certifite). Enter the defult vcenter Single Sign-On user nme dministrtor@vsphere.lol nd the vsphere_dmin pssword. VMwre, In. 18

19 Certifite Replement d e f g Selet Option 2 (Import ustom ertifite(s) nd key(s) to reple existing Mhine SSL ertifite). When prompted for the ustom ertifite, enter /root/erts/sfo01ps01.1.er. When prompted for the ustom key, enter /root/erts/sfo01ps01.key. When prompted for the signing ertifite, enter /root/erts/root64.er. h When prompted to Continue opertion, enter Y. The Pltform Servies Controller servies utomtilly restrt. 5 Verify tht the new ertifite hs een instlled suessfully. Open We Browser nd go to Verify tht the We rowser shows the new ertifite. 6 After Certifite Mnger reples the ertifites, restrt the vmi-lighttp servie to updte the ertifite in the virtul pplition mngement interfe (VAMI) of nd to remove ertifite files from Pltform Servies Controller. servie vmi-lighttp restrt d /root/erts rm sfo01ps01.1.er sfo01ps01.key Root64.er 7 Swith the shell k to the ppline shell. hsh -s /in/pplinesh root 8 Rediret ll trffi from the Compute nd Edge Pltform Servies Controller to the Mngement Pltform Servies Controller. See Diret Trffi to Compute Pltform Servies Controller in Region A Vlue NSX Mnger NSX Edge devie Pltform Servies Controller to re-enle Pltform Servies Controller to disle sfo01ps01 sfo01m01ps01 sfo01w01ps01 Pools pool-1 pool-2 9 Repet the proedure to reple the ertifite on sfo01w01ps01.sfo01.rinpole.lol. Updte the Pltform Servies Controller Certifites on the Mngement Components in Region A After you reple the ertifite on а Pltform Servies Controller instne, updte the ertifite on the vcenter Server nd NSX Mnger instnes in the region. VMwre, In. 19

20 Certifite Replement 1 Log in to vcenter Server y using Seure Shell (SSH) lient. Open n SSH onnetion to the sfo01m01v01.sfo01.rinpole.lol virtul mhine. Log in using the following redentils. User nme Pssword Vlue root venter_server_root_pssword 2 Restrt the servies of vcenter Server. Swith from the vcenter Server Appline ommnd shell to the Bsh shell. shell Restrt vcenter Server servies y using the following ommnd. servie-ontrol --stop --ll servie-ontrol --strt --ll 3 Repet the steps to restrt the servies on the sfo01w01v01.sfo01.rinpole.lol vcenter Server. 4 Reonnet NSX Mnger to Pltform Servies Controller nd vcenter Server fter you instll the ustom ertifites on the nodes. See Connet NSX Mnger to vcenter Server in Region A. 5 Reonnet Site Reovery Mnger nd vsphere Replition to Pltfrom Servies Controller nd vcenter Server fter you instll the ustom ertifites on the nodes. See Updte Mngement vcenter Server Certifite on Site Reovery Mnger in Region A nd Register vsphere Replition with vcenter Single Sign-On in Region A Re-Enle Compute Pltform Servies Controller on the Lod Blner in Region A After you reple the ertifite on the Pltform Servies Controller instnes, re-lne trffi etween them. VMwre, In. 20

21 Certifite Replement 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 2 From the Home menu of the vsphere We Client, selet Networking & Seurity. 3 In the Nvigtor, lik NSX Edges. 4 From the NSX Mnger drop-down menu, selet Restore the lod lner onfigurtion. d e Doule-lik the sfo01ps01 edge devie to open its network settings. On the Mnge t, lik the Lod Blner t nd lik Pools. Selet pool-1 nd lik Edit. Selet the sfo01w01ps01 memer, lik Edit, selet Enled from the Stte drop-down menu, nd lik OK. Repet the steps to enle sfo01w01ps01 in pool-2. Reple the vcenter Server Certifites in Region A Reple the ertifite on eh vcenter Server instne in Region A nd reonnet it to the other mngement omponents to updte the new ertifite on these omponents. 1 Reple the Certifite of the Mngement vcenter Server in Region A To estlish trusted onnetion with the other SDDC mngement omponents, you reple the mhine SSL ertifite on eh vcenter Server instne in region with ustom ertifite. The ertifite, tht is generted y the CertGenVVD utility, is signed y the ertifite uthority (CA) ville on the prent Ative Diretory (AD) server or on the intermedite Ative Diretory (AD) server. 2 Connet NSX Mnger to vcenter Server in Region A 3 Updte the Certifite of the Compute vcenter Server on the Cloud Mngement Pltform in Region A After you reple the ertifite on the Compute vcenter Server instne in Region A, reonnet vrelize Orhestrtor, vrelize Business nd vrelize Automtion to vcenter Server to updte the vcenter Server ertifite on the Cloud Mngement Pltform. VMwre, In. 21

22 Certifite Replement 4 Updte the vcenter Server Certifites on vrelize Opertions Mngerin Region A After you hnge the ertifite of vcenter Server instne in Region A, updte the ertifites on the onneted vrelize Opertions Mnger node y reonneting the vcenter Adpter nd vsan Adpter instnes. 5 Updte Mngement vcenter Server Certifite on Site Reovery Mnger in Region A After you reple the ertifite of the Pltform Servies Controller pir or of the Mngement vcenter Server, updte the ertifite on the onneted Site Reovery Mnger instne in Region A to re-trust the onnetion. 6 Register vsphere Replition with vcenter Single Sign-On in Region A Reple the Certifite of the Mngement vcenter Server in Region A To estlish trusted onnetion with the other SDDC mngement omponents, you reple the mhine SSL ertifite on eh vcenter Server instne in region with ustom ertifite. The ertifite, tht is generted y the CertGenVVD utility, is signed y the ertifite uthority (CA) ville on the prent Ative Diretory (AD) server or on the intermedite Ative Diretory (AD) server. Tle 1 4. Certifite-Relted Files on the vcenter Server Instnes vcenter Server FQDN Files for Certifite Replement sfo01m01v01.sfo01.rinpole.lol sfo01m01v01.key sfo01m01v01.1.er Root64.er sfo01w01v01.sfo01.rinpole.lol sfo01w01v01.key sfo01w01v01.1.er Root64.er 1 Log in to vcenter Server y using Seure Shell (SSH) lient. Open n SSH onnetion to the sfo01m01v01.sfo01.rinpole.lol virtul mhine. Log in using the following redentils. User nme Pssword Vlue root venter_server_root_pssword 2 Chnge the vcenter Server ppline ommnd shell to the Bsh shell to llow seure opy (sp) onnetions for the root user. shell hsh -s "/in/sh" root VMwre, In. 22

23 Certifite Replement 3 Copy the generted ertifites to the vcenter Server Appline. Run the following ommnd to rete new temporry folder. mkdir -p /root/erts Copy the ertifite files sfo01m01v01.1.er, sfo01m01v01.key nd Root64.er to the /root/erts folder. You n use n sp softwre suh s WinSCP. 4 Reple the CA-signed ertifite on the vcenter Server instne. Strt the vsphere Certifite Mnger utility on the vcenter Server instne. /usr/li/vmwre-vm/in/ertifite-mnger Selet Option 1 (Reple Mhine SSL ertifite with Custom Certifite), enter the defult vcenter Single Sign-On user nme dministrtor@vsphere.lol nd the vsphere_dmin_pssword pssword. When prompted for the Infrstruture Server IP, enter the IP ddress of the Pltform Servies Controller tht mnges this vcenter Server instne. Option IP Address of Conneted Pltform Servies Controller sfo01m01v01.sfo01.rinpole.lol d e Selet Option 2 (Import ustom ertifite(s) nd key(s) to reple existing Mhine SSL ertifite). When prompted, provide the full pth to the ustom ertifite, the root ertifite file, nd the key file tht you opied over erlier, nd onfirm the import with Yes (Y). vcenter Server sfo01m01v01.sfo01.rinpole.lol sfo01w01v01.sfo01.rinpole.lol Input to the vsphere Certifite Mnger Utility Plese provide vlid ustom ertifite for Mhine SSL. File : /root/erts/sfo01m01v01.1.er Plese provide vlid ustom key for Mhine SSL. File : /root/erts/sfo1m01v01.кey Plese provide the signing ertifite of the Mhine SSL ertifite. File : /root/erts/root64.er Plese provide vlid ustom ertifite for Mhine SSL. File : /root/erts/sfo01w01v01.1.er Plese provide vlid ustom key for Mhine SSL. File : /root/erts/sfo01w01v01.key Plese provide the signing ertifite of the Mhine SSL ertifite. File : /root/erts/root64.er 5 After Sttus shows 100% Completed, wit severl minutes until ll vcenter Server servies re restrted. VMwre, In. 23

24 Certifite Replement 6 Open the vsphere We lient to verify tht ertifite replement is suessful. Open We rowser nd go to Verify tht you see the new ertifite. 7 Restrt the vmi-lighttp servie to updte the ertifite on the virtul ppline mngement interfe (VAMI) nd to remove ertifite files. servie vmi-lighttp restrt d /root/erts/ rm sfo01m01v01.1.er sfo01m01v01.key Root64.er 8 After you reple the ertifite on the sfo01m01v01.sfo01.rinpole.lol vcenter Server, repet the proedure to reple the ertifite on the ompute vcenter Server sfo01w01v01.sfo01.rinpole.lol. Connet NSX Mnger to vcenter Server in Region A After you reple the ertifites of the Pltform Servies Controller nd vcenter Server instnes in Region A, you reonnet the NSX Mnger instnes to the Pltform Servies Controller nd vcenter Server nodes in the region to updte the ertifites on NSX Mnger. 1 Log in to the Mngement NSX Mnger ppline user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin nsx_mnger_dmin_pssword 2 Clik Mnge vcenter Registrtion. 3 Under Lookup Servie URL, lik Edit. 4 In the Lookup Servie URL dilog ox, enter the following settings nd lik OK. Lookup Servie Host Vlue sfo01ps01.sfo01.rinpole.lol Lookup Servie Port 443 SSO Administrtor User Nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 5 In the Trust Certifite? dilog ox, lik Yes. 6 Under vcenter Server, lik Edit. VMwre, In. 24

25 Certifite Replement 7 In the vcenter Server dilog ox, enter the following settings, nd lik OK. Vlue for NSX Mnger for the Mngement Cluster Vlue for NSX Mnger for the Shred Edge nd Compute Cluster vcenter Server sfo01m01v01.sfo01.rinpole.lol sfo01w01v01.sfo01.rinpole.lol vcenter User Nme sv-nsxmnger@rinpole.lol sv-nsxmnger@rinpole.lol Pssword sv-nsxmnger_pssword sv-nsxmnger_pssword 8 In the Trust Certifite? dilog ox, lik Yes. 9 Wit for the Sttus inditors for the Lookup Servie URL nd vcenter Server to hnge to the Conneted sttus. 10 Repet the proedure to onnet NSX Mnger for the shred edge nd ompute luster sfo01w01nsx01.sfo01.rinpole.lol to the Pltform Servies Controller lod lner nd Compute vcenter Server. Updte the Certifite of the Compute vcenter Server on the Cloud Mngement Pltform in Region A After you reple the ertifite on the Compute vcenter Server instne in Region A, reonnet vrelize Orhestrtor, vrelize Business nd vrelize Automtion to vcenter Server to updte the vcenter Server ertifite on the Cloud Mngement Pltform. 1 Reonnet vrelize Orhestrtor to vcenter Server. Open We Browser nd go to Clik Strt Orhestrtor Client. On the VMwre vrelize Orhestrtor login pge, log in to the emedded vrelize Orhestrtor y using the following host nme nd redentils. Host nme User nme Pssword Vlue sv-vr sv-vr-pssword d e f g h In the left pne, lik Workflows, nd nvigte to Lirry > vcenter > Configurtion. Right-lik the Updte vcenter Server instne workflow nd lik Strt Workflow. From the vcenter Server instne drop-down menu, selet nd lik Next. Enter the pssword for the sv-vro@rinpole.lol user ount nd lik Sumit. Clik Yes to ignore the ertifite wrnings nd lik Next. VMwre, In. 25

26 Certifite Replement 2 Reonnet vrelize Business to vcenter Server. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue root vr_olletor_root_pssword d e f Clik Mnge Privte Cloud Connetions, selet vcenter Server, selet the sfo01w01v01.sfo01.rinpole.lol entry nd lik the Edit ion. In the Edit vcenter Server Connetion dilog ox, enter the pssword for the svvr@rinpole.lol user nd lik Sve. In the SSL Certifite wrning dilog ox, lik Instll. In the Suess dilog ox, lik OK. 3 Rerete the vsphere endpoint in vrelize Automtion. Open We rowser nd go to Log in using the following redentils. User nme Pssword Domin Vlue vr-dmin-rinpole vr-dmin-rinpole_pssword rinpole.lol d e Nvigte to Infrstruture > Endpoints > Endpoints. Hve your mouse over sfo01w01v01.sfo01.rinpole.lol nd lik Edit from the menu. On the Edit Endopint - vsphere (vcenter) pge, lik OK. f In the ertifite wrning dilog ox, lik OK to ept the new ertifite. Updte the vcenter Server Certifites on vrelize Opertions Mnger in Region A After you hnge the ertifite of vcenter Server instne in Region A, updte the ertifites on the onneted vrelize Opertions Mnger node y reonneting the vcenter Adpter nd vsan Adpter instnes. VMwre, In. 26

27 Certifite Replement 1 Log in to vrelize Opertions Mnger y using the opertions interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrops_dmin_pssword 2 On the min nvigtion r, lik Administrtion. 3 In the left pne of vrelize Opertions Mnger, under Mngement, lik Certifites. 4 Selet the rows tht ontin CN=sfo01m01v01.sfo01.rinpole.lol nd CN=sfo01w01v01.sfo01.rinpole.lol, nd lik the Delete ion. 5 In the left pne of vrelize Opertions Mnger, lik Solutions. 6 Reonnet eh vcenter Adpter. Selet the VMwre vsphere solution nd lik Configure. In the Mnge Solutions dilog ox, selet vcenter Adpter - sfo01m01v01, lik Test Connetion, ept the new ertifite of the Mngement vcenter Server, nd lik Sve s. In the Mnge Solutions dilog ox, selet vcenter Adpter - sfo01w01v01, lik Test Connetion, ept the new ertifite of the Compute vcenter Server, nd lik Sve s. 7 Reonnet the VMwre vsan dpter for the mngement luster. In the left pne of vrelize Opertions Mnger, lik Solutions. Selet the VMwre vsan solution nd lik Configure. In the Mnge Solutions dilog ox, selet vsan Adpter - sfo01m01v01, lik Test Connetion, ept the new ertifite of the Mngement vcenter Server, nd lik Sve s. Updte Mngement vcenter Server Certifite on Site Reovery Mnger in Region A After you reple the ertifite of the Pltform Servies Controller pir or of the Mngement vcenter Server, updte the ertifite on the onneted Site Reovery Mnger instne in Region A to re-trust the onnetion. Reonnet the two site reovery sites fter you re-trust the ertifite of Pltform Servies Controller nd vcenter Server. VMwre, In. 27

28 Certifite Replement 1 Log in to the Site Reovery Mnger virtul mhine y using Remote Desktop Protool (RDP) lient. Open n RDP onnetion to the sfo01m01srm01.sfo01.rinpole.lol virtul mhine. Log in using the following redentils. s User nme Pssword Vlue Windows dministrtor user windows_dministrtor_pssword 2 Open Progrms nd Fetures from the Windows Control Pnel. 3 Selet VMwre vcenter Site Reovery Mnger nd lik Chnge. The VMwre Site Reovery Mnger instlltion wizrd ppers. 4 On the Welome pge, lik Next. 5 On the Progrm Mintenne pge, selet Modify nd lik Next. 6 On the vsphere Pltform Servies Controller pge, enter the pssword for uthentition to Pltform Servies Controller, verify tht the settings re orret nd lik Next. Address Vlue sfo01ps01.sfo01.rinpole.lol HTTPS Port 443 Usernme Pssword sv-srm@rinpole.lol sv-srm_pssword 7 When prompted to ept the ertifite of the Pltform Servies Controller in the Pltform Servies Controller Certifite dilog ox, lik Aept. 8 On the VMwre vcenter Server pge, lik Next. 9 When prompted, in the vcenter Server Certifite dilog ox, lik Aept. 10 On the Site Reovery Mnger Extension pge, leve the existing settings, nd lik Next. Administrtor E-mil Vlue srm_dmin_sfo_emil_ddress Lol Host Listener Port On the Certifite Type pge, selet Use existing ertifite nd lik Next. 12 On the Dtse Server Seletion pge, selet Use the emedded dtse server nd lik Next. VMwre, In. 28

29 Certifite Replement 13 On the Emedded Dtse Configurtion pge, enter the dtse pssword, leve the existing settings nd lik Next. Dt Soure Nme Dtse User Nme Dtse Pssword Vlue SRM_SITE_SFO srm_d_dmin srm_d_dmin_sfo_pssword Dtse Port 5678 Connetion Count 5 Mx. Connetions On the Site Reovery Mnger Servie Aount pge, enter pssword for the dministrtor user, leve the existing redentils, nd lik Next. Vlue Use Lol System ount Usernme Pssword Deseleted MGMT01SRM01\Administrtor mgmt01srm01_dmin_pssword 15 On the Redy to Instll the Progrm pge, lik Instll. 16 Clik Finish to omplete the instlltion. 17 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 18 Reonnet the Site Reovery Mnger instne in Region A. From the Home menu, selet Site Reovery. On the Site Reovery pge, lik Sites. On the Sites pge, right-lik mgmt01v01.sfo01.rinpole.lol nd selet Reonfigure Piring. The Reonfigure Site Reovery Mnger Server Piring wizrd ppers. VMwre, In. 29

30 Certifite Replement d On the Selet Site pge, vlidte the following settings nd lik Next. s PSC ddress Vlue lx01ps51.lx01.rinpole.lol Port 443 e On the Selet vcenter Server pge, enter the dministrtor@vsphere.lol pssword, vlidte the following settings, nd lik Finish. s vcenter Servers with mthing SRM Extension Usernme Pssword Vlue mgmt01v51.lx01.rinpole.lol sv-srm@rinpole.lol sv-srm_pssword Register vsphere Replition with vcenter Single Sign-On in Region A After you reple the defult or expiring ertifite on the vsphere Replition ppline, reonnet it to vcenter Single Sign-on on the Pltform Servies Controller pir in the region. 1 Log in to the Virtul Appline Mngement Interfe of the vsphere Replition ppline. Open We rowser nd go to Log in using the following redentils. s User nme Pssword Vlue root vr_sfo_root_pssword 2 On the VR t, lik Configurtion, enter the following settings, nd lik Sve nd Restrt Servie. Configurtion Mode LookupServie Address SSO Administrtive Aount Pssword Vlue Configure using the emedded dtse sfo01ps01.sfo01.rinpole.lol sv-vr@rinpole.lol sv-vr_pssword VRM Host VRM Site Nme vcenter Server Address sfo01m01v01.sfo01.rinpole.lol sfo01m01v01.sfo01.rinpole.lol vcenter Server Port 80 vcenter Server Admin Mil venter_server_dmin_emil 3 In the Confirm SSL Certifite dilog ox, lik Aept. VMwre, In. 30

31 Certifite Replement 4 Wit for the vsphere Replition Mngement (VRM) server to sve the onfigurtion. 5 Under Servie Sttus, verify tht the sttus of the VRM servie is running. 6 Log out from the vsphere Replition ppline mngement interfe. 7 Reonnet the sites to resolve the onnetion issue. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword d e f On the vsphere We Client Home pge, lik vsphere Replition. On the Home t, selet sfo01m01v01.sfo01.rinpole.lol, lik Mnge, nd selet Trget Sites. Right-lik lx01m01v01.lx01.rinpole.lol nd lik Reonnet site. In the Reonnet Sites dilog ox, lik Yes to proeed. Reple the ESXi Host Certifites in Region A Reple the defult or expired ertifites on the ESXi hosts with ertifites tht re generted y using the CertGenVVD utility. In eh luster, you onfigure the ertifite mode for hosts to support ustom ertifite uthorities (CAs) nd reple the old ertifites with ertifites tht re signed y ustom CA. 1 Set Host Certifite Mode on the Mngement vcenter Server to Support Custom Certifite Authority in Region A By defult the ESXi hosts re utomtilly provisioned with VMwre Certifite Authority (VMCA) ertifites when they re onneted to vcenter Server. Set the host ertifite mode on vcenter Server to support ustom ertifite uthority so tht vcenter Server stops pushing VMCA ertifites on to the ESXi hosts. 2 Reple the Defult Certifites with Custom Certifites on the Mngement ESXi Hosts in Region A After you otin signed ertifites for the ESXi hosts in the region nd onfigure vcenter Server to ept ustom ertifite uthorities, reple the defult VMwre Certifite Authority (VMCA) signed ertifites with the ustom ones on the hosts. VMwre, In. 31

32 Certifite Replement 3 Configure Certifite Mode for nd Reple Certifites on the Hosts in the Shred Edge nd Compute Cluster in Region A After you reple the ertifites of the ESXi hosts in the mngement luster, omplete ertifite replement in Region A on the hosts in the shred edge nd ompute luster. Set Host Certifite Mode on the Mngement vcenter Server to Support Custom Certifite Authority in Region A By defult the ESXi hosts re utomtilly provisioned with VMwre Certifite Authority (VMCA) ertifites when they re onneted to vcenter Server. Set the host ertifite mode on vcenter Server to support ustom ertifite uthority so tht vcenter Server stops pushing VMCA ertifites on to the ESXi hosts. vcenter Server sfo01m01v01.sfo01.rinpole.lol ESXi Host sfo01m01esx01.sfo01.rinpole.lol sfo01m01esx02.sfo01.rinpole.lol sfo01m01esx03.sfo01.rinpole.lol sfo01m01esx04.sfo01.rinpole.lol 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 2 Verify tht ll CA ertifites from vcenter Server re updted on ll hosts. In the Nvigtor, under Hosts nd Cluster, selet sfo01m01esx01.sfo01.rinpole.lol, nd lik the Configure t. Under System, selet Certifite nd lik Refresh CA Certifites. Repet the steps for the ESXi hosts tht re ontrolled y the Mngement vcenter Server sfo01m01v01.sfo01.rinpole.lol. 3 Chnge the ertifite mode for the ESXi hosts in the mngement luster to ustom. In the Nvigtor, under Hosts nd Cluster, selet sfo01m01v01.sfo01.rinpole.lol, nd lik the Configure t. Under s, lik Advned s nd lik Edit. VMwre, In. 32

33 Certifite Replement d In the filter ox, enter ertmgmt nd press Enter to view only ertifite mngement properties. Chnge the vlue of the vpxd.ertmgmt.mode property to ustom nd lik OK. 4 Restrt the vcenter Server Appline to pply the hnges. Open We rowser nd go to Log in using the following redentils. s User nme Pssword Vlues root venter_server_root_pssword Clik Reoot to restrt the vcenter Server Appline. Reple the Defult Certifites with Custom Certifites on the Mngement ESXi Hosts in Region A After you otin signed ertifites for the ESXi hosts in the region nd onfigure vcenter Server to ept ustom ertifite uthorities, reple the defult VMwre Certifite Authority (VMCA) signed ertifites with the ustom ones on the hosts. You reple the ertifite seprtely on eh hosts in the mngement luster. Tle 1 5. Certifite Files Nmes for the Mngement Hosts in Region A ESXi Hosts Certifite File Nmes sfo01m01esx01.sfo01.rinpole.lol sfo01m01esx01.key sfo01m01esx01.1.er sfo01m01esx02.sfo01.rinpole.lol sfo01m01esx02.key sfo01m01esx02.1.er sfo01m01esx03.sfo01.rinpole.lol sfo01m01esx03.key sfo01m01esx03.1.er sfo01m01esx04.sfo01.rinpole.lol sfo01m01esx04.key sfo01m01esx04.1.er 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword VMwre, In. 33

34 Certifite Replement 2 Disle lokdown mode on the sfo01m01esx01.sfo01.rinpole.lol host. d e f g h From the Home menu of the vsphere We Client, selet Hosts nd Clusters. Under the sfo01-m01d dt enter, selet the sfo01m01esx01.sfo01.rinpole.lol host ojet nd lik the Configure t on the right. Under System, lik Seurity Profile, sroll down to Lokdown Mode, nd lik Edit. In the Lokdown Mode dilog ox, selet Disled nd lik OK. Sroll up to the Servies pne nd lik Edit. In Edit Seurity Profile dilog ox, selet SSH. Clik the Strt utton if the sttus is not showing up s Running Clik OK to lose the Edit Seurity Profile dilog ox. 3 Ple the host in mintenne mode. Under the sfo01-m01d dt enter, right-lik the sfo01m01esx01.sfo01.rinpole.lol host ojet nd selet Mintenne Mode > Enter Mintenne Mode. In the Confirm Mintenne Mode dilog ox, selet Move powered-off nd suspended virtul mhines to other hosts in the luster nd lik OK. 4 Reple the ertifite files on the host. After the mintenne tsk is omplete, open n SSH onnetion to the sfo01m01esx01.sfo01.rinpole.lol host using the following redentils. Option User nme Pssword Desription root esxi_root_user_pssword Copy the sfo01m01esx01.key nd sfo01m01esx01.1.er files from the Windows host where you run the CertGenVVD tool to the /et/vmwre/ssl diretory on the host. Run the following ommnds to k up the present ertifite nd key files nd to reple them with the generted files. d /et/vmwre/ssl t rui.rt >> rui.k t rui.key >> rui.k mv sfo01m01esx01.key rui.key mv sfo01m01esx01.1.er rui.rt 5 Restrt the mngement gents on the host. Run the dui ommnd to open the Diret Console User Interfe (DCUI). Press the F12 key to ess the System Customiztion menu. Selet Trouleshooting Options nd press Enter. VMwre, In. 34

35 Certifite Replement d e f g Selet Restrt Mngement Agents nd press Enter. Press F11 key to onfirm the restrt nd press Enter to onfirm ompletion. Press Control+C to lose dui pplition. Run the following ommnds to restrt the vsnvpd nd vsnmgmtd servies /et/init.d/vsnvpd restrt /et/init.d/vsnmgmtd restrt 6 Verify tht the ustom ertifite is instlled. Open We rowser nd go to Verify tht the ertifite returned y the host is signed y Rinpole insted of y VMwre. 7 Exit mintenne mode of the host. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword d e From the Home menu, selet Hosts nd Clusters. Under the sfo01-m01d dt enter, right-lik the sfo01m01esx01.sfo01.rinpole.lol host ojet nd selet Mintenne Mode > Exit Mintenne Mode. Mke sure tht no wrning messge out n untrusted sfo01m01esx01.sfo01.rinpole.loll ertifite ppers. 8 Reonnet the ESXi host to vcenter Server to refresh the host ertifite on vcenter Server. Under the sfo01-m01d dt enter, right-lik the sfo01m01esx01.sfo01.rinpole.lol host ojet nd selet Connetion > Disonnet. Clik Yes in the Confirm Disonnet pop-up window. Wit until the host is disonneted. d Right-lik the sfo01m01esx01.sfo01.rinpole.lol host ojet nd selet Connetion > Connet. e On the Configure t, under System, selet Certifites nd verify tht the ertifite displyed for the host is the new one. VMwre, In. 35

36 Certifite Replement 9 Verify tht the storge providers re online for the ESXi host. d Selet the sfo01m01v01.sfo01.rinpole.lol vcenter Server ojet nd lik the Configure t. Under More, selet Storge Providers. Verify tht the sttus for the /version.xml URL of the vsan storge provider is Online. If the sttus of the URL is different from Online, selet the URL, lik the Unregister the seleted storge provider ion, nd lik Synhronizes ll the storge providers with the urrent sttes of the environment ion. 10 Repet the proedure for the rest of the mngement ESXi hosts in the region. Configure Certifite Mode for nd Reple Certifites on the Hosts in the Shred Edge nd Compute Cluster in Region A After you reple the ertifites of the ESXi hosts in the mngement luster, omplete ertifite replement in Region A on the hosts in the shred edge nd ompute luster. Tle 1 6. Certifite Files Nmes for the Shred Edge nd Compute Hosts in Region A ESXi Hosts Certifite File Nmes sfo01w01esx01.sfo01.rinpole.lol sfo01w01esx01.key sfo01w01esx01.1.er sfo01w01esx02.sfo01.rinpole.lol sfo01w01esx02.key sfo01w01esx02.1.er sfo01w01esx03.sfo01.rinpole.lol sfo01w01esx03.key sfo01w01esx03.1.er sfo01w01esx04.sfo01.rinpole.lol sfo01w01esx04.key sfo01w01esx04.1.er u Repet Set Host Certifite Mode on the Mngement vcenter Server to Support Custom Certifite Authority in Region A nd Reple the Defult Certifites with Custom Certifites on the Mngement ESXi Hosts in Region A to reple the ertifites on the hosts under the sfo01w01v01.sfo01.rinpole.lol vcenter Server. Reple the NSX Mnger Certifites in Region A Reple the ertifite on n NSX Mnger instne, for exmple, if it is out to expire, nd updte it on the mngement omponents onneted to this instne. 1 Reple the Certifite of NSX Mnger for the Mngement Cluster in Region A 2 Connet NSX Mnger to the Mngement vcenter Server in Region A VMwre, In. 36

37 Certifite Replement 3 Re-Join Seondry NSX Mnger to Primry NSX Mnger in Region A After you reple the ertifite on NSX Mnger in Region A, updte its ertifite on the pired NSX Mnger in Region B. 4 Reple the NSX Mnger Certifite for the Shred Edge nd Compute Cluster in Region A After you deploy the ppline of NSX Mnger, reple the defult ertifite with ustomer ertifite to estlish trusted onnetion with the mngement omponents in the SDDC. The ertifite, tht is generted y the CertGenVVD utility, is signed y ertifite uthority (CA) on the prent Ative Diretory server. 5 Reonnet NSX Mnger in Region A to vrelize Opertions Mnger After you reple the ertifite on eh NSX Mnger instne in the region, reonnet the NSX dpter in vrelize Opertions Mnger to updte the ertifite on vrelize Opertions Mnger. Reple the Certifite of NSX Mnger for the Mngement Cluster in Region A After you reple the ertifites of ll Pltform Servies Controller instnes nd ll vcenter Server instnes, reple the expiring ertifites for the NSX Mnger instnes. Use the following ertifite file to reple the ertifite on the NSX Mnger instne: Tle 1 7. Certifite-Relted Files on the NSX Mnger Instne for the Mngement Cluster in Region A NSX Mnger FQDN Certifite File Nme sfo01m01nsx01.sfo01.rinpole.lol sfo01m01nsx01.4.p12 1 Log in to the Mngement NSX Mnger ppline user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin nsx_mnger_dmin_pssword 2 On the Home pge, selet Mnge Appline s. 3 On the Mnge t, lik SSL Certifites, lik Uplod PKCS#12 Keystore. 4 Browse to the ertifite hin file sfo01m01nsx01.4.p12, provide the keystore pssword or pssphrse, nd lik Import. 5 Restrt the NSX Mnger to propgte the CA-signed ertifite. In the right orner of the NSX Mnger pge, lik the s ion. From the drop-down menu, selet Reoot Appline. VMwre, In. 37

38 Certifite Replement Connet NSX Mnger to the Mngement vcenter Server in Region A After you reple the ertifite of n NSX Mnger instne, you reonnet it to Pltform Servies Controller nd vcenter Server to updte the ertifite on these omponents. 1 Log in to the Mngement NSX Mnger ppline user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin nsx_mnger_dmin_pssword 2 Clik Mnge vcenter Registrtion. 3 Under Lookup Servie URL, lik Edit. 4 In the Lookup Servie URL dilog ox, enter the following settings nd lik OK. Lookup Servie Host Vlue sfo01ps01.sfo01.rinpole.lol Lookup Servie Port 443 SSO Administrtor User Nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 5 In the Trust Certifite? dilog, lik Yes. 6 Under vcenter Server, lik Edit. 7 In the vcenter Server dilog, enter the following settings, nd lik OK. vcenter Server vcenter User Nme Pssword Vlue sfo01m01v01.sfo01.rinpole.lol sv-nsxmnger@rinpole.lol sv-nsxmnger_pssword 8 In the Trust Certifite? dilog, lik Yes. 9 Wit for the Sttus inditors for the Lookup Servie URL nd vcenter Server to hnge to the Conneted sttus. Re-Join Seondry NSX Mnger to Primry NSX Mnger in Region A After you reple the ertifite on NSX Mnger in Region A, updte its ertifite on the pired NSX Mnger in Region B. VMwre, In. 38

39 Certifite Replement 1 Log in to vcenter Server y using the vsphere We Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dministrtor@vsphere.lol vsphere_dmin_pssword 2 From the Home menu of the vsphere We Client, selet Networking & Seurity. 3 In the Nvigtor, lik NSX Edges. 4 Clik Instlltion in the Nvigtor. 5 From the NSX Mnger drop-down menu, selet Selet Ations > Disonnet from Primry NSX Mnger. Roles Primry Seondry Mngement NSX Mnger Instnes in Both Regions On the Mngement t, selet the instne from the NSX Mnger drop-down menu. 8 Selet Ations > Add Seondry NSX Mnger. 9 In the Add Seondry NSX Mnger dilog ox, enter the following settings nd lik OK. Mngement NSX Mnger in Region B NSX Mnger User nme Pssword Confirm Pssword dmin nsx_mnger_dmin_pssword nsx_mnger_dmin_pssword 10 In the Trust Certifite onfirmtion dilog ox, lik Yes. Reple the NSX Mnger Certifite for the Shred Edge nd Compute Cluster in Region A After you deploy the ppline of NSX Mnger, reple the defult ertifite with ustomer ertifite to estlish trusted onnetion with the mngement omponents in the SDDC. The ertifite, tht is generted y the CertGenVVD utility, is signed y ertifite uthority (CA) on the prent Ative Diretory server. Use the following files to reple the ertifite on NSX Mnger for the shred edge nd ompute luster: VMwre, In. 39

40 Certifite Replement Tle 1 8. Certifite-Relted Files on the NSX Mnger Instne for the Shred Edge nd Compute Cluster in Region A NSX Mnger FQDN Certifite File Nme sfo01w01nsx01.sfo01.rinpole.lol sfo01w01nsx01.4.p12 1 Log in to the Compute NSX Mnger ppline user interfe. Open We rowser nd go to Log in using the following redentils. Vlue User nme dmin Pssword nsx_mnger_dmin_pssword 2 On the Home pge, selet Mnge Appline s. 3 On the Mnge t, lik SSL Certifites, lik Uplod PKCS#12 Keystore. 4 Browse to the ertifite hin file sfo01w01nsx01.4.p12, provide the keystore pssword or pssphrse, nd lik Import. 5 Restrt the NSX Mnger to propgte the CA-signed ertifite. In the right orner of the NSX Mnger pge, lik the s ion. From the drop-down menu, selet Reoot Appline. Reonnet NSX Mnger in Region A to vrelize Opertions Mnger After you reple the ertifite on eh NSX Mnger instne in the region, reonnet the NSX dpter in vrelize Opertions Mnger to updte the ertifite on vrelize Opertions Mnger. 1 Log in to vrelize Opertions Mnger y using the dministrtion interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrops_dmin_pssword 2 On the min nvigtion r, lik Administrtion. 3 In the left pne of vrelize Opertions Mnger, lik Certifites under Mngement. VMwre, In. 40

41 Certifite Replement 4 Delete the ertifites with the following CNs. CN=sfo01m01nsx01.sfo01.rinpole.lol CN=sfo01w01nsx01.sfo01.rinpole.lol 5 In the left pne of vrelize Opertions Mnger, lik Solutions. 6 From the solution tle on the Solutions pge, selet the Mngement Pk for NSX-vSphere solution, nd lik the Configure ion t the top. 7 In the Mnge Solutions dilog ox, from the Adpter Type tle t the top, selet NSX-vSphere Adpter. 8 Clik the sfo01m01nsx01-sfo01 dpter instne, lik Test Connetion, ept the new ertifite, nd lik Sve settings. 9 Clik the sfo01w01nsx01-sfo01 dpter instne, lik Test Connetion, ept the new ertifite, lik Sve settings, nd lik Close. Reple Certifites of the Opertions Mngement Components in Region A If the ertifite of vrelize Opertions Mnger or vrelize Log Insight expires, reple it nd updte it on the mngement omponents in the region to mintin seure onnetion. 1 Reple vrelize Opertions Mnger Certifite in Region A Use the PEM file tht is generted using the CertGenVVD utility to reple the urrent ertifite on the vrelize Opertions Mnger dministrtor user interfe. You re-onnet vrelize Automtion to vrelize Opertions Mnger to updte the ertifite in the worklod relmtion onnetion. 2 Reple the Certifite of vrelize Log Insight in Region A Updte the ertifite hin of vrelize Log Insight to use trusted non-defult ertifite fter deployment or to reple ertifite tht is soon to expire. In this wy, onnetion to the vrelize Log Insight user interfe remins trusted. 3 Updte the SSL Certifite for Event Forwrding to Region B After you reple the ertifite of vrelize Log Insight in Region A, you updte log forwrding from vrelize Log Insight in Region A to vrelize Log Insight in Region B. Log forwrding in this vlidted design uses SSL onnetion to exhnge log dt. Reple vrelize Opertions Mnger Certifite in Region A Use the PEM file tht is generted using the CertGenVVD utility to reple the urrent ertifite on the vrelize Opertions Mnger dministrtor user interfe. You re-onnet vrelize Automtion to vrelize Opertions Mnger to updte the ertifite in the worklod relmtion onnetion. VMwre, In. 41

42 Certifite Replement 1 Log in to the vrelize Opertions Mnger dministrtor user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrops_dmin_pssword 2 At the upper right orner of the UI, lik the yellow SSL Certifite ion. 3 In the SSL Certifite dilog ox, lik Instll New Certifite. 4 Clik Browse, lote the vrops.2.hin.pem PEM file, nd lik Open. 5 Verify the ertifite detils nd lik Instll. 6 Updte the vrelize Opertions Mnger ertifite for worklod relmtion ommunition with vrelize Automtion. Open We rowser nd go to Log in using the following redentils. User nme Pssword Domin Vlue vr-dmin-rinpole vr-dmin-rinpole_pssword rinpole.lol d e Nvigte to Administrtion > Relmtion > Metris Provider. On the Metris Provider pge, lik Test Connetion for the vrelize Opertions Mnger endpoint provider, verify tht the test onnetion is suessful, nd lik Sve In the ertifite wrning messge ox, lik OK. Reple the Certifite of vrelize Log Insight in Region A Updte the ertifite hin of vrelize Log Insight to use trusted non-defult ertifite fter deployment or to reple ertifite tht is soon to expire. In this wy, onnetion to the vrelize Log Insight user interfe remins trusted. VMwre, In. 42

43 Certifite Replement 1 Log in to the vrelize Log Insight user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrli_dmin_pssword 2 In the vrelize Log Insight user interfe, lik the onfigurtion drop-down menu ion nd selet Administrtion. 3 Under Configurtion, lik SSL. 4 On the SSL Configurtion pge, next to New Certifite File (PEM formt) lik Choose File, rowse to the lotion of the PEM file on your omputer, nd lik Sve. Certifite Genertion Option Using the CertGenVVD tool Certifite File vrli.sfo01.2.hin.pem The ertifite is uploded to vrelize Log Insight. 5 Open We rowser nd go to A wrning messge tht the onnetion is not trusted ppers. 6 To review the ertifite, lik the pdlok in the ddress r of the rowser, nd verify tht Sujet Alterntive Nme ontins the nmes of the vrelize Log Insight luster nodes. 7 Import the ertifite in your We rowser. For exmple, in Google Chrome under the HTTPS/TLS settings lik Mnge ertifites, nd in the Certifites dilog ox import vrli-hin.pem. You n lso use Certifite Mnger on Windows or Keyhin Aess on MAC OS X. Updte the SSL Certifite for Event Forwrding to Region B After you reple the ertifite of vrelize Log Insight in Region A, you updte log forwrding from vrelize Log Insight in Region A to vrelize Log Insight in Region B. Log forwrding in this vlidted design uses SSL onnetion to exhnge log dt. VMwre, In. 43

44 Certifite Replement 1 Open Seure Shell onnetion to the vrelize Log Insight node. Open n SSH session nd go to the vrelize Log Insight node. Nme lx01vrli01.lx01.rinpole.lol Role Mster node lx01vrli01.lx01.rinpole.lol Worker node 1 lx01vrli01.lx01.rinpole.lol Worker node 2 Log in using the following redentils. Nme User nme Pssword Role root vrli_regionb_root_pssword 2 Import the root ertifite in the Jv truststore on eh vrelize Log Insight node in Region B. Crete working diretory on the vrelize Log Insight node. mkdir /tmp/ssl d /tmp/ssl Extrt the root ertifite from the destintion vrelize Log Insight in Region A. eho "" openssl s_lient -showerts -servernme sfo01vrli01.sfo01.rinpole.lol -onnet sfo01vrli01.sfo01.rinpole.lol:443 -prexit 2>/dev/null sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p' > ert.pem split -f individul- ert.pem '/-----BEGIN CERTIFICATE-----/' '{*}' root_ert=$(ls individul-* sort -n -t- til -1) p -f -- "$root_ert" root.rt Import the root.rt in the Jv truststore of the vrelize Log Insight node in Region B. d /usr/jv/defult/li/seurity/../../in/keytool -import -lis loginsight -file /tmp/ssl/root.rt -keystore erts d e f When prompted for keystore pssword, type hngeit. When prompted to ept the ertifite, type yes. Reoot the vrelize Log Insight node. reoot g Repet this opertion on ll vrelize Log Insight nodes in Region B. VMwre, In. 44

45 Certifite Replement 3 Log in to the vrelize Log Insight user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword Vlue dmin vrli_dmin_pssword 4 In the vrelize Log Insight user interfe, lik the onfigurtion drop-down menu ion nd selet Administrtion. 5 Under Mngement, lik Event Forwrding. 6 On the Event Forwrding pge, selet LAX01 to SFO01 nd lik the Edit ion. 7 In the Edit Destintion dilog ox, lik Test to verify tht the onnetion settings re orret. 8 Clik Sve to sve the forwrding new destintion. Reple Certifites of the Cloud Mngement Pltform Components in Region A After you generte signed ertifites for the Cloud Mngement Pltform, reple them nd updte them on the mngement omponents in the region to mintin seure onnetion. 1 Reple the vrelize Automtion Certifite in Region A Reple the existing ertifite for ll vrelize Automtion servies from the vrelize Automtion Mngement Console. You reple the ertifite on the vrelize Automtion Appline, IS We server nd IS Mnger server to mintin trusted ommunition etween the vrelize Automtion nodes. 2 Updte the vrelize Automtion Certifite on vrelize Orhestrtor nd vrelize Business in Region A After you updte the vrelize Automtion ertifite, reonnet vrelize Orhestrtor nd vrelize Business to vrelize Automtion to instll the new ertifite. 3 Updte the vrelize Automtion Certifite on vrelize Opertions Mnger in Region A After you hnge the ertifite of the vrelize Automtion Appline nd IS omponents, updte the ertifite on vrelize Opertions Mnger to keep the ommunition trusted y reonneting the vrelize Automtion Adpter. 4 Reple the SSL Certifite on vrelize Business Server in Region A Reple the defult or existing SSL ertifite of vrelize Business with new one using the vrelize Business ppline mngement onsole. This ertifite is used when you ess the We interfe of the vrelize Business server. VMwre, In. 45

46 Certifite Replement Reple the vrelize Automtion Certifite in Region A Reple the existing ertifite for ll vrelize Automtion servies from the vrelize Automtion Mngement Console. You reple the ertifite on the vrelize Automtion Appline, IS We server nd IS Mnger server to mintin trusted ommunition etween the vrelize Automtion nodes. 1 Log in to the vrelize Automtion ppline mngement onsole. Open We Browser nd go to Log in using the following redentils. User nme Pssword Vlue root vr_ppa_root_pssword 2 On vra s t, lik the Dtse t. 3 If vr01svr01.rinpole.lol is the MASTER node, log in to using the root user nme nd the vr_ppb_root_pssword pssword insted. 4 On vra s t, lik the Host s t. 5 Under SSL Configurtion, selet Import next Certifite Ation. 6 From text editor on the Windows host where you run the CertGenVVD utility, opy the ontent of the following ertifite files nd pste it in the orresponding text oxes in the user interfe, nd lik Sve s. Soure Content vr.key vr.3.pem Pssphrse tht you optionlly entered t genertion Trget Text Box RSA Privte Key Certifite Chin Pssphrse VMwre, In. 46

47 Certifite Replement 7 Sroll down on the pge nd verify tht ll luster nodes hve een suessfully updted. 8 Clik the Certifites t nd repet the proedure to onfigure the IS We server nd IS Mnger Servie with the new ertifite detils. IS Component IS We server IS Mnger Servie Component Type IS We Mnger Servie Updte the vrelize Automtion Certifite on vrelize Orhestrtor nd vrelize Business in Region A After you updte the vrelize Automtion ertifite, reonnet vrelize Orhestrtor nd vrelize Business to vrelize Automtion to instll the new ertifite. VMwre, In. 47