当前位置： 首页 > article >正文

[个人笔记] vCenter6.7使用自建SSL证书

article 2024/9/24 12:30:42

SSL - 运维篇

第三章 vCenter6.7使用自建SSL证书

  • SSL - 运维篇
  • 系列文章回顾
  • vCenter6.7使用自建SSL证书
    • vCenter 6.7 上传文件到Shell
    • vCenter 6.7 Shell 替换SSL证书全流程
    • 测试&验证
  • 参考链接

系列文章回顾

第二章 FortiGate防火墙使用自建SSL证书

vCenter6.7使用自建SSL证书

本文仅实验过VMware vCenter 6.7版本


vCenter 6.7 上传文件到Shell

# VCSA默认情况下, root用户使用的shell是appliancesh, 因此无法通过WinSCP来登录VCSA和上传文件
# 需要更改root用户的shell为bash, 如下所示.
chsh -s /bin/bash root
# 上传文件后，再改回appliancesh.
chsh -s /bin/appliancesh root

vCenter 6.7 Shell 替换SSL证书全流程

/var/lib/vmware/vmca/root.cer					# vCenter默认ROOT存放路径
/var/lib/vmware/vmca/privatekey.pem				# vCenter默认存放私钥路径
/usr/lib/vmware-vmca/share/config/vmca.reg		# vCenter VMCA的reg配置
/usr/lib/vmware-vmca/share/config/certool.cfg	# vCenter 生成CSR证书签名请求的默认配置参数


### 新增自定义SSL证书存储的路径
root@vCenter [ ~ ]# mkdir -p /opt/vmware/etc/ssl/cert-backup/

### 使用vCenter自带的证书管理工具为vCenter生成csr证书签名请求和密钥
root@vCenter [ ~ ]# /usr/lib/vmware-vmca/bin/certificate-manager		# vCenter 证书管理工具
                 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
                |                                                                     |
                |      *** Welcome to the vSphere 6.7 Certificate Manager  ***        |
                |                                                                     |
                |                   -- Select Operation --                            |
                |                                                                     |
                |      1. Replace Machine SSL certificate with Custom Certificate     |
                |                                                                     |
                |      2. Replace VMCA Root certificate with Custom Signing           |
                |         Certificate and replace all Certificates                    |
                |                                                                     |
                |      3. Replace Machine SSL certificate with VMCA Certificate       |
                |                                                                     |
                |      4. Regenerate a new VMCA Root Certificate and                  |
                |         replace all certificates                                    |
                |                                                                     |
                |      5. Replace Solution user certificates with                     |
                |         Custom Certificate                                          |
                |                                                                     |
                |      6. Replace Solution user certificates with VMCA certificates   |
                |                                                                     |
                |      7. Revert last performed operation by re-publishing old        |
                |         certificates                                                |
                |                                                                     |
                |      8. Reset all Certificates                                      |
                |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 
--> 1		# Replace Machine SSL certificate with Custom Certificate 用自定义证书替换计算机SSL证书
--> administrator@xxx.com
--> <password>
--> 1		# Generate Certificate Signing Request(s) and Key(s) for Machine SSL certificate 为机器SSL证书生成证书签名请求和密钥
--> /opt/vmware/etc/ssl/cert-backup/		# 输出CSR和KEY的目录
--> CN										# Country [C]
--> vCenter.xxx.com							# Name [CN]
--> xxx Technology Co., Ltd.				# Organization [O]
--> [部门]									# OrgUnit [OU]
--> [省]									# State [ST]
--> [市]									# Locality [L]
--> [vCenter的ip地址]						# IPAddress
--> [邮箱]									# Email
--> [vCenter的FQDN]							# Hostname
--> [vCenter内置的CA名称]					# VMCA Name
--> 2										# Exit certificate-manager 退出证书管理工具

### 通过vCenter自带的证书管理工具导出csr和key文件
root@vCenter [ ~ ]# ls /opt/vmware/etc/ssl/cert-backup/
vmca_issued_csr.csr  vmca_issued_key.key  ca.cer

参考 【转】VMware使用自签名证书替换vSphere各组件自带SSL证书 完成 Windows Server 2016 CA 的证书模板颁发过程

mmc.exe --> 添加/删除管理单元 --> 证书模板
0
1
2
3
4
5
6
7

### 上传ca根证书文件和ssl证书, 重命名csr文件和key文件
root@vCenter [ ~ ]# chsh -s /bin/bash root			
root@vCenter [ ~ ]# scp root@ca.xxx.com:/tmp/ca.cer /opt/vmware/etc/ssl/cert-backup/
root@vCenter [ ~ ]# scp root@ca.xxx.com:/tmp/vcenter.cer /opt/vmware/etc/ssl/cert-backup/
root@vCenter [ ~ ]# chsh -s /bin/appliancesh root	# 切换回appliancesh
root@vCenter [ ~ ]# mv /opt/vmware/etc/ssl/cert-backup/vmca_issued_csr.csr /opt/vmware/etc/ssl/cert-backup/vcenter.csr
root@vCenter [ ~ ]# mv /opt/vmware/etc/ssl/cert-backup/vmca_issued_csr.key /opt/vmware/etc/ssl/cert-backup/vcenter.key
root@vCenter [ ~ ]# ls /opt/vmware/etc/ssl/cert-backup/
vcenter.cer  vcenter.csr  vcenter.key  ca.cer

### 通过vCenter自带的证书管理工具开始导入SSL证书
root@vCenter [ ~ ]# /usr/lib/vmware-vmca/bin/certificate-manager		# vCenter 证书管理工具
                 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
                |                                                                     |
                |      *** Welcome to the vSphere 6.7 Certificate Manager  ***        |
                |                                                                     |
                |                   -- Select Operation --                            |
                |                                                                     |
                |      1. Replace Machine SSL certificate with Custom Certificate     |
                |                                                                     |
                |      2. Replace VMCA Root certificate with Custom Signing           |
                |         Certificate and replace all Certificates                    |
                |                                                                     |
                |      3. Replace Machine SSL certificate with VMCA Certificate       |
                |                                                                     |
                |      4. Regenerate a new VMCA Root Certificate and                  |
                |         replace all certificates                                    |
                |                                                                     |
                |      5. Replace Solution user certificates with                     |
                |         Custom Certificate                                          |
                |                                                                     |
                |      6. Replace Solution user certificates with VMCA certificates   |
                |                                                                     |
                |      7. Revert last performed operation by re-publishing old        |
                |         certificates                                                |
                |                                                                     |
                |      8. Reset all Certificates                                      |
                |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 
--> 1		# Replace Machine SSL certificate with Custom Certificate 用自定义证书替换计算机SSL证书
--> administrator@xxx.com
--> <password>
--> 2		# Import custom certificate(s) and key(s) to replace existing Machine SSL certificate 导入自定义证书和密钥以替换现有的计算机SSL证书
Please provide valid custom certificate for Machine SSL.
File : /opt/vmware/etc/ssl/cert-backup/vcenter.cer	# SSL证书签发文件

Please provide valid custom key for Machine SSL.
File : /opt/vmware/etc/ssl/cert-backup/vcenter.key	# SSL证书私钥

Please provide the signing certificate of the Machine SSL certificate
File : /opt/vmware/etc/ssl/cert-backup/ca.cer		# ROOTCA证书链

You are going to replace Root Certificate with custom certificate and regenerate all other certificates
Continue operation : Option[Y/N] ? : Y				# 开始执行导入SSL证书, 等待vCenter进度条执行完毕



### 查看vCenter的所有证书store信息
root@vCenter [ ~ ]# /usr/lib/vmware-vmafd/bin/vecs-cli store list
MACHINE_SSL_CERT
TRUSTED_ROOTS
TRUSTED_ROOT_CRLS
machine
vsphere-webclient
vpxd
vpxd-extension
APPLMGMT_PASSWORD
data-encipherment
SMS
vcenter.xxx.com		# 自定义SSL证书的store
BACKUP_STORE_H5C
BACKUP_STORE

# 查看指定store证书链(密文)
root@vCenter [ ~ ]# /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store vcenter.xxx.com
Number of entries in store :    1
Alias : vcenter.xxx.com
Entry type :    Private Key
Certificate :   ...

# 查看指定store证书链解析(明文)
root@vCenter [ ~ ]# /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store vcenter.xxx.com --text
Number of entries in store :    1
Alias : vcenter.xxx.com
Entry type :    Private Key
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ...
    Signature Algorithm: sha256WithRSAEncryption
        ...
         
# 查看指定store证书链的指定alias证书信息解析(明文)
root@vCenter [ ~ ]# /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store TRUSTED_ROOTS --alias <alias> --text

测试&验证

浏览器打开vCenter的WebUI，提示HTTPS连接是安全的。
1
2



参考链接

  1. 【转】VMware使用自签名证书替换vSphere各组件自带SSL证书
  2. vecs-cli 命令参考

http://www.kler.cn/news/148695.html

相关文章：

  • UE5 范围内随机生成
  • 1. TiDB-Operator 备份到 Minio
  • RK3566RK3568 安卓11 在framework层进行串口通信
  • 【LeetCode】70. 爬楼梯
  • 服务器运行train.py报错解决
  • 成功的蓝图：实现长期成长与卓越表现的 6 项策略
  • 如何使用ArcGIS实现生态廊道模拟
  • 针对MySql知识的回顾
  • nodejs 如何将 Buffer 数据转为 String
  • 条形码格式
  • 位运算算法【1】
  • UI自动化的基本知识
  • Hive进阶函数：SPACE() 一行炸裂指定行
  • 【栈和队列（1）（逆波兰表达式）】
  • Ps：子路径的上下排列以及对齐与分布
  • 【开发实践】使用POI实现导出带有复杂表头的的excel文件
  • 璞华大数据产品入选中国信通院“铸基计划”
  • 【开源】基于Vue+SpringBoot的学校热点新闻推送系统
  • 梦极光（ez_re???）
  • MYSQL基础知识之【LIKE子句的使用 ，NULL值的处理，空值的处理】
  • ArrayList和顺序表
  • 服务器中深度学习环境的配置
  • 使用OSS搭建私有云内网yum仓库的方法
  • 盖茨表示GPT-5不会比GPT-4有太大改进；Intro to Large Language Models
  • 羽隔已就之图像处理之BP神经网络入门
  • C++ day36 贪心算法 无重叠区间 划分字母区间 合并区间
  • 计算机网络高频面试八股文
  • 解决Hadoop DataNode ‘Incompatible clusterIDs‘报错
  • 关于Unity中字典在Inspector的显示
  • 一、Lua基础