VMware VCSA use XCA for Root and Intermediate Certificate Authority

File / New Database / create the database file and master password.

1. New Root Certificate.
2. Click on the Certificate tab. Click on the New Certificate button.
3. Choose the [default] CA template and click apply all.
4. Click on the subject tab.
5. Internal name and common name – root.my.lab   The rest of the boxes are subjective.
6. Click “Generate a new key”. The defaults are fine.
   Click the Extensions tab. For the x509v3 Subject Alternative Name use DNS:root.my.lab You can add a common and add IP: if desired. Click OK.

1. Click on the root.my.lab cert and then click the new certificate button.
   Choose the root.my.lab as the “use this certificate for signing. Choose the [default] CA template and click apply all.
2. Click on the subject tab.
   Internal name and common name – intermediate.my.lab
   The rest of the boxes are subjective.
3. Click “Generate a new key”. The defaults are fine.
4. Click the Extensions tab. For the x509v3 Subject Alternative Name use DNS:intermediate.my.lab You can add a common and add IP: if desired.
5. Click OK. Click “Adjust date and continue”

1. Click on the intermediate.my.lab cert and click new certificate.
   intermediate.my.lab should already by picked for “use this certificate for signing”. the Empty template is fine.
   Internal name and common name – vcsa2.my.lab
   The rest of the boxes are subjective.
2. Click “Generate a new key”. The defaults are fine.
3. Click on the Extensions tab. Change the time range to 3 year (up to you if 1 is ok)
   For the x509v3 Subject Alternative Name use DNS:vcsa2.my.lab
   You can add a common and add IP: if desired
4. Click the Key Usage tab. Select Digital Signature, Non Repudiation, Key Encipherment (left click on each one).
   Check off “critical” under X509 Key Usage.

1. Click on the vcsa2.my.lab cert. Click export. Name the file machine.crt and choose PEM (*.crt).
   You can open the machine.crt in notepad++ and with windows explorer to validate the —–BEGIN CERTIFICATE—– text.
2. Click on the vcsa2.my.lab cert. Click export. Name the file machine-key.pem
   Choose PEM + key (*.pem).
   Open machine-key.pem with notepad++ and REMOVE line —–BEGIN CERTIFICATE—– and all lines underneath.
   Save.
3. Click on the root.my.lab cert. Click export.
   Choose PEM (*.crt)
4. Click on the intermediate.my.lab cert. Click export.
   Choose PEM (*.crt)
5. Click on the intermediate.my.lab cert. Click export.
   Name the file rootandint.pem
   Choose PEM chain (*.crt)

On the machine that will access the VCSA website.

1. In windows explorer, open root.my.lab.crt Click install certificate. Choose the trusted root folder. Click OK to the warning popup.
2. In windows explorer, open intermediate.my.lab.crt Click install certificate. Choose the Intermediate folder.
3. In windows explorer, open machine.crt and it should list the 3 certs in the path (how the web browser will see it).

VCSA 6.7.0.20100 build 11338176 (embedded PSC)
Makes sure you have a snapshot of the VCSA before the change. (I prefer to take the snapshot while the VCSA VM is power off)

1. Enable SSH and shell via the VAMI :5480 https://fqdn:5480/ui/access
   ssh and enable winscp access
   chsh -s /bin/bash root
2. winscp in, upload the 3 files to /tmp
   machine.crt
   machine-key.pem
   rootandint.pem
3. remove winscp access via
   chsh -s /bin/appliancesh root
   Disable ssh and shell via the VAMI.

SSH into the VCSA

/usr/lib/vmware-vmca/bin/certificate-manager
1
2

Please provide valid custom certificate for Machine SSL.
File : /tmp/machine.crt

Please provide valid custom key for Machine SSL.
File : /tmp/machine-key.pem

Please provide the signing certificate of the Machine SSL certificate-manager
File: /tmp/rootandint.pem

1. Validate the URL. You may need to open in incognito mode.
2. Validate all apps that talk to the VC that may need manual intervention to allow the new cert. (ex. NSX Manager)
3. Remove the snapshot.