---
title: "vCenter Server 6 – Replacing SSL certificates with Custom VMCA"
date: "2016-02-17T13:32:23Z"
tags: ["Certificate", "Certificate Authority", "SSL", "VMCA"]
categories: ["Networking & Security", "VMware"]
---

![vCenter Server 6. - Replacing SSL certificates with custom VMCA logo][1]

In earlier post <a href="https://www.wojcieh.net/replace-vmware-esxi-6-ssl-certificate/" target="_blank" rel="noopener noreferrer">How to replace VMware ESXi 6.* SSL certificate</a>I described how to replace VMware ESXi 6.\* SSL certificate. This post will focus on replacing SSL certificates with Custom VMCA in vCenter Server 6.\* on Windows.
<!--more-->
<!--adsense-->
# Prerequsites

* Certificate Authority.
* Template for VMware in Certificate Authority – follow VMware Knowledge Base Article for details: <a href="http://kb.vmware.com/kb/2112009" target="_blank" rel="noopener noreferrer">Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 6.0 (2112009)</a>.
* XCA – Optional to store all certificates, requests and private keys.

# VMCA topologies

I am not going to copy&paste VMware documentation - it is easier to read it. Below you will find a list of interesting documentation (in my opinion of course) to read:

* <a href="http://pubs.vmware.com/vsphere-60/topic/com.vmware.vsphere.security.doc/GUID-4469A6D3-048A-471C-9CB4-518A15EA2AC0.html" target="_blank" rel="noopener noreferrer">Certificate Replacement Overview</a>
* <a href="http://pubs.vmware.com/vsphere-60/topic/com.vmware.vsphere.security.doc/GUID-3AF7757E-A30E-4EEC-8A41-28DA72102520.html" target="_blank" rel="noopener noreferrer">Where vSphere 6.0 Uses Certificates</a>

Today we will use VMware Certificate Authority (VMCA) in **custom** topology. This means VMCA will be used only to store certificates for all vCenter Server solutions and all certificate replacement has to be done manually.

# Replacing SSL certificates with custom VMCA

## Replacing vCenter Server machine_ssl certificate

1. Login to vCenter Server and start command line.
2. In command line go to directory where you installed vCenter Server 6.*. In my case it is default directory: **C:\Program Files\VMware\vCenter Server\vmcad\**.
3. Start tool called **certificate-manager** and select operation **1**.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 1][2]
4. Provide valid SSO password and hit Enter. Choose Operation 1 - Generate Certificate Signing Request(s) and Key(s) for Machine SSL certificate and hit Enter.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 2][3]
5. Enter directory path where CSR and private key will be saved. For simplicity I created directory C:\SSL.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 3][4]
6. Certificate Signing Request and private key to machine_ssl was generated successfully.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 4][5]
7. I am not going to bore you to death by approving all certificates and documenting it. Check my earlier post where I did it - <a href="https://www.wojcieh.net/replace-vmware-esxi-6-ssl-certificate/#CertificateSigning" target="_blank" rel="noopener noreferrer">How to replace VMware ESXi 6.* SSL certificate.</a>
8. Once certificate is signed and saved to local disk we return to certificate-manager tool to replace certificates. Click 1 and hit Enter.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 5][6]
9. As requested provide path to certificate, certificate signing request and root certificate authority certificate. Hit Enter and select Y to continue operation of replacing machine_ssl certificate.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 6a][7]
10. Certificate manager will replace machine_ssl certificate and restart vCenter Server services. It takes a while to do it so do not worry. If everything was configured correctly operation will succeed.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 7][8]

## Replacing vCenter Server solution user certificates (machine, vpxd, vpxd-extension, vsphere-webclient)

We will continue with replacement of other certificates.

1. Start certificate manager and select option 5 - Replace Solution user certificates with Custom Certificate.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 8][9]
2. Provide valid SSO password and hit Enter.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 9][10]
3. Select option 1 to generate CSRs and provide directory location where CSRs will be saved.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 10][11]
4. Sign all CSRs in your certificate authority - see <a href="https://www.wojcieh.net/replace-vmware-esxi-6-ssl-certificate/#CertificateSigning" target="_blank" rel="noopener noreferrer">How to replace VMware ESXi 6.* SSL certificate</a> link.
5. Once signed we can start to replace all solution user certificates.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 11][12]
6. Return to certificate manager and choose option 1 to continue certificate replacement. Provide path to all certificates, private keys and root certificate authority certificate.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 12][13]
7. Hit Enter and select Y to continue. vCenter Server solution user certificates will be stopped and vCenter Server services will be restarted. Once completed we finished our task to replace vCenter Server SSL certificates.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 13][14]
8. To check if certificate was replaced successfully simply check certificate in vSphere Web Client.<br>
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 14][15]

# Additional tasks

One of the most important things to change right after replacing certificates is to change vCenter Server certificate mode from default vmca to **custom**. In order to do that follow VMware documentation: Change the Certificate Mode. If you will not change it you will have problems with High Availability - in short words, vCenter Server will not trust your ESXi hotsts SSL thumbprints and HA will not work.

This is what you will see in HA information field.
  
![vCenter Server 6. - Replacing SSL certificates with custom VMCA - 15][16]

From my experience there are several things that you have to be really careful about:

* Correct template of certificate in your certificate authoriy
* Certificate authority can't overwrite any field in certificate. If it will be done vCenter Services will not start properly.
* You will not see vsphere-webclient certificate SSL certificate browser. This is ok - by design machine_ssl certificate is used as reverse proxy. Read more: <a href="http://pubs.vmware.com/vsphere-60/topic/com.vmware.vsphere.security.doc/GUID-3AF7757E-A30E-4EEC-8A41-28DA72102520.html" target="_blank" rel="noopener noreferrer">Where vSphere 6.0 Uses Certificates</a>.

[1]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-logo.webp
[2]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-1.webp
[3]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-2.webp
[4]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-3.webp
[5]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-4.webp
[6]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-5.webp
[7]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-6a.webp
[8]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-7.webp
[9]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-8.webp
[9]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-7.webp
[9]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-8.webp
[10]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-9.webp
[11]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-10.webp
[12]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-11.webp
[13]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-12.webp
[14]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-13.webp
[15]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-14.webp
[16]: /images/uploads/2016/02/vcenter-server-6.-replacing-ssl-certificates-with-custom-vmca-15.webp