VM SSL证书到期完整过程-日志输出
root@dmzvcsa [ /etc/vmware-rhttpproxy/ssl ]# ping dmzvcsa.lcyydmz.com
PING dmzvcsa.lcyydmz.com (127.0.0.1) 56(84) bytes of data.
64 bytes from dmzvcsa.lcyydmz.com (127.0.0.1): icmp_seq=1 ttl=64 time=0.056 ms
64 bytes from dmzvcsa.lcyydmz.com (127.0.0.1): icmp_seq=2 ttl=64 time=0.052 ms
^C
— dmzvcsa.lcyydmz.com ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.052/0.054/0.056/0.002 ms
root@dmzvcsa [ /etc/vmware-rhttpproxy/ssl ]# cd
root@dmzvcsa [ ~ ]# cd /usr/lib/vmware-vmca/bin/
root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]# ./cert
certerrorvalidator certificate-manager certool
root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]# ./certificate-manager
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.7 Certificate Manager *** |
| |
| — Select Operation — |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y/N] ? :
Please enter any value with in [Y/N]. : Option[Y/N] ? : y
Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:Traceback (most recent call last):
File “./certificate-manager”, line 762, in
exit(main())
File “./certificate-manager”, line 756, in main
parse_arguments()
File “./certificate-manager”, line 734, in parse_arguments
read_and_validate_password()
File “/usr/lib/vmware/site-packages/cis/certificateManagerOps.py”, line 367, in read_and_validate_password
password = getpass.getpass(prompt=’Enter password:’)
File “/usr/lib/python3.5/getpass.py”, line 77, in unix_getpass
passwd = raw_input(prompt, stream, input=input) File “/usr/lib/python3.5/getpass.py”, line 146, in _raw_input line = input.readline() KeyboardInterrupt root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]# ./certificate-manager _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.7 Certificate Manager *** |
| |
| — Select Operation — |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 4
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : Y
Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:
Incorrect Password! Try Again! (2 attempt/s left)
Password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ? : Y
Press Enter key to skip optional parameters or use Previous value.
Enter proper value for ‘Country’ [Previous value : US] :
Enter proper value for ‘Name’ [Previous value : CA] :
Enter proper value for ‘Organization’ [Previous value : VMware] :
Enter proper value for ‘OrgUnit’ [Previous value : VMware Engineering] :
Enter proper value for ‘State’ [Previous value : California] :
Enter proper value for ‘Locality’ [Previous value : Palo Alto] :
Enter proper value for ‘IPAddress’ (Provide comma separated values for multiple IP addresses) [optional] : 192.168.60.42
Enter proper value for ‘Email’ [Previous value : email@acme.com] :
Enter proper value for ‘Hostname’ (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : dmzvcsa.lcyydmz.com
Enter proper value for VMCA ‘Name’ :lcyy
You are going to regenerate Root Certificate and all other certificates using VMCA
Continue operation : Option[Y/N] ? : Y
Get site nameCompleted [Replacing Machine SSL Cert…]
default-site
Lookup all services
Get service default-site:5110e260-045a-4c6a-9bfb-d9e677b97332
Don’t update service default-site:5110e260-045a-4c6a-9bfb-d9e677b97332
Get service default-site:b8d01bf3-1bf0-4e0c-880a-34004969f817
Don’t update service default-site:b8d01bf3-1bf0-4e0c-880a-34004969f817
Get service default-site:9517a58b-9864-42f2-afbc-5ff31594748d
Don’t update service default-site:9517a58b-9864-42f2-afbc-5ff31594748d
Get service cb4da056-ec54-40fb-a128-408c279853fa
Don’t update service cb4da056-ec54-40fb-a128-408c279853fa
Get service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14_com.vmware.vsphere.client
Don’t update service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14_com.vmware.vsphere.client
Get service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14
Don’t update service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14
Get service 9fa5833c-3515-4329-9125-a9f38b0b7061
Don’t update service 9fa5833c-3515-4329-9125-a9f38b0b7061
Get service 77ed8ffb-5514-4bcb-9917-b1251f8c40b5
Don’t update service 77ed8ffb-5514-4bcb-9917-b1251f8c40b5
Get service 04996eb7-44ff-49e3-936b-71bc356fc0fd
Don’t update service 04996eb7-44ff-49e3-936b-71bc356fc0fd
Get service 67af0faa-7f8c-4291-b5a6-f76065da1544
Don’t update service 67af0faa-7f8c-4291-b5a6-f76065da1544
Get service d9d03f94-a935-4236-81d6-849d6cafe10d
Don’t update service d9d03f94-a935-4236-81d6-849d6cafe10d
Get service e1c6d612-425e-4978-b854-e43866791cb3
Don’t update service e1c6d612-425e-4978-b854-e43866791cb3
Get service d9b936d9-1f9b-4c7d-9f66-22223a279daa
Don’t update service d9b936d9-1f9b-4c7d-9f66-22223a279daa
Get service 74e86005-66bc-456c-bf53-b8bb9c53f65b
Don’t update service 74e86005-66bc-456c-bf53-b8bb9c53f65b
Get service a910ebd5-d0a3-4185-be92-e1c0a6a7baca
Don’t update service a910ebd5-d0a3-4185-be92-e1c0a6a7baca
Get service d9351b0e-13de-40bd-837b-c954b61b6ff1
Don’t update service d9351b0e-13de-40bd-837b-c954b61b6ff1
Get service e7d30769-9afd-4360-a6ce-2c45d4dff5de_kv
Don’t update service e7d30769-9afd-4360-a6ce-2c45d4dff5de_kv
Get service 298648ac-29fd-4fe8-a7ea-cb5cc4e64c0c
Don’t update service 298648ac-29fd-4fe8-a7ea-cb5cc4e64c0c
Get service e7d30769-9afd-4360-a6ce-2c45d4dff5de
Don’t update service e7d30769-9afd-4360-a6ce-2c45d4dff5de
Get service e7d30769-9afd-4360-a6ce-2c45d4dff5de_authz
Don’t update service e7d30769-9afd-4360-a6ce-2c45d4dff5de_authz
Get service 66e189de-21a7-4bbc-8e60-5027174f2cdf
Don’t update service 66e189de-21a7-4bbc-8e60-5027174f2cdf
Get service 09592aaa-287e-4e24-beaa-a25df17eaedd
Don’t update service 09592aaa-287e-4e24-beaa-a25df17eaedd
Get service c9789487-6c4b-4d34-bc85-21dc4ef284a7
Don’t update service c9789487-6c4b-4d34-bc85-21dc4ef284a7
Get service eff5228d-dd9e-4c05-91aa-14c6192fade7
Don’t update service eff5228d-dd9e-4c05-91aa-14c6192fade7
Get service d7e109da-534a-4b2a-bc13-3860f255db0d
Don’t update service d7e109da-534a-4b2a-bc13-3860f255db0d
Get service 9dc882ee-8040-47b5-80c7-8e6e1ea9a56b
Don’t update service 9dc882ee-8040-47b5-80c7-8e6e1ea9a56b
Get service ef709fcc-f8fd-4e0a-b4f0-2ad5c975a329
Don’t update service ef709fcc-f8fd-4e0a-b4f0-2ad5c975a329
Get service 59fc0d8c-0fdb-40a2-be78-b40fcd51b2fe
Don’t update service 59fc0d8c-0fdb-40a2-be78-b40fcd51b2fe
Get service 643a1131-bbe1-4d31-b541-028a68d70e95
Don’t update service 643a1131-bbe1-4d31-b541-028a68d70e95
Get service 26dcd1c8-2cd7-4249-82f5-5ceae7d21516
Don’t update service 26dcd1c8-2cd7-4249-82f5-5ceae7d21516
Get service 919318f5-8f61-4337-ab96-a682e6ae6b2d
Don’t update service 919318f5-8f61-4337-ab96-a682e6ae6b2d
Get service 974ae59c-c8ac-4153-a06c-c5b3289c60ac
Don’t update service 974ae59c-c8ac-4153-a06c-c5b3289c60ac
Get service a2814d49-80c2-4816-a2b0-a7634855c4c7
Don’t update service a2814d49-80c2-4816-a2b0-a7634855c4c7
Get service e523c4cd-2ccf-44d2-b01e-5d3d2ea5afb8
Don’t update service e523c4cd-2ccf-44d2-b01e-5d3d2ea5afb8
Get service c15d8bd8-504a-4393-8825-9765a6463af9
Don’t update service c15d8bd8-504a-4393-8825-9765a6463af9
Updated 0 service(s)
Status : 60% Completed [Replace vpxd-extension Cert…]
2024-08-16T10:28:51.135Z Updating certificate for “com.vmware.vim.eam” extension
2024-08-16T10:28:51.532Z Updating certificate for “com.vmware.rbd” extension
2024-08-16T10:28:51.926Z Updating certificate for “com.vmware.imagebuilder” extension
Status : 85% Completed [starting services…]
Status : 100% Completed [All tasks completed successfully]
root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]#
root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]#
root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]# openssl s_client -connect dmzvcsa.lcyydmz.com:443 -showcerts
CONNECTED(00000003)
depth=1 CN = lcyy, DC = vsphere, DC = local, C = US, ST = California, O = dmzvcsa.lcyydmz.com, OU = VMware Engineering
verify return:1
depth=0 CN = dmzvcsa.lcyydmz.com, C = US, ST = California, L = Palo Alto, O = VMware, OU = VMware Engineering
verify return:1
Certificate chain
0 s:/CN=dmzvcsa.lcyydmz.com/C=US/ST=California/L=Palo Alto/O=VMware/OU=VMware Engineering
i:/CN=lcyy/DC=vsphere/DC=local/C=US/ST=California/O=dmzvcsa.lcyydmz.com/OU=VMware Engineering
—–BEGIN CERTIFICATE—–
MIIEbzCCA1egAwIBAgIJAP4229mP03AoMA0GCSqGSIb3DQEBCwUAMIGcMQ0wCwYD
VQQDDARsY3l5MRcwFQYKCZImiZPyLGQBGRYHdnNwaGVyZTEVMBMGCgmSJomT8ixk
ARkWBWxvY2FsMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEcMBoG
A1UECgwTZG16dmNzYS5sY3l5ZG16LmNvbTEbMBkGA1UECwwSVk13YXJlIEVuZ2lu
ZWVyaW5nMB4XDTI0MDgxNjEwMTgxMFoXDTI2MDgxNjEwMTgxMFowgYIxHDAaBgNV
BAMME2RtenZjc2EubGN5eWRtei5jb20xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApD
YWxpZm9ybmlhMRIwEAYDVQQHDAlQYWxvIEFsdG8xDzANBgNVBAoMBlZNd2FyZTEb
MBkGA1UECwwSVk13YXJlIEVuZ2luZWVyaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAt7RgGONXLq08epzk2dZFdUsjpqZsngWyoWOw1/SMjEkFRiO+
aBXBsW0sUQAExIuq4nuVvO2greoN+hL3sKcFWvX18GCJgiC/KF1Rp+RGYORraM/S
KzND/Yrdv4xnPhBn8xXfVFwYDTztgeKfwxS8pNAjvCLW4RHo3YoBdXvrYWWOpclV
PB+pZZiJAHm37h4MVu5Sxi4H+qN3zwTN18YZ20oMhixYuWVs9hQejDDVmf7E/1lw
60mhrHycI/644PcWy53BPrqGdBF0gDWNzZL4zDBPbhhxu7vFcYcfzRCyVx3ESKXT
P3aEEhw3+lsKor7zn0n4tFKIVFCgyOVjNgcH/wIDAQABo4HLMIHIMAsGA1UdDwQE
AwIF4DA0BgNVHREELTArgQ5lbWFpbEBhY21lLmNvbYcEwKg8KoITZG16dmNzYS5s
Y3l5ZG16LmNvbTAdBgNVHQ4EFgQUoulUcA79l7+C+SqEyOohU3W13lcwHwYDVR0j
BBgwFoAUPu7ExGkDaJufLhlsuINtj92WyZkwQwYIKwYBBQUHAQEENzA1MDMGCCsG
AQUFBzAChidodHRwczovL2RtenZjc2EubGN5eWRtei5jb20vYWZkL3ZlY3MvY2Ew
DQYJKoZIhvcNAQELBQADggEBAGkxq0CWBZq4FTdV/71fuGVPozMOObm9/DeJ/L16
eKcnA4tcfpP3T2dSSCqJ7Ob7P3UVNIhmsuDDFhmgILiZSBFIRsHADjCri6ZgzssT
SViaDV6D9C4+GI0E7vH3K99JpzbSsElUT/62aybmm5GtECkuz17EVZyMzzYEeiRl
dzjWWTxsrVlH3VndnBIRhSBHQ/mwatsAYN5kMbWw0Jodu9mqotUTKixu6+W9meOM
Drk2SYUMpp2mi4iTJx8ooZSK6vI3VHLr7HkTQB+F6P7J/pGj2VRKJle1qK+LolC6
uMP43adyWukkkDN4zv6lQRlMi8xx6o/mordgN9OIQxFR+Jk=
—–END CERTIFICATE—–
Server certificate
subject=/CN=dmzvcsa.lcyydmz.com/C=US/ST=California/L=Palo Alto/O=VMware/OU=VMware Engineering
issuer=/CN=lcyy/DC=vsphere/DC=local/C=US/ST=California/O=dmzvcsa.lcyydmz.com/OU=VMware Engineering
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
SSL handshake has read 1619 bytes and written 433 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: 165825F90B700F14FDD2FE503AAEFB1E30EF46DB5C11A96B626A7C90522247C7C208F00C6DC87AA68E7702DBA9463681
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1723804369
Timeout : 300 (sec)
Verify return code: 0 (ok)
^C
root@dmzvcsa [ /usr/lib/vmware-vmca/bin ]# timed out waiting for input: auto-logout
Command>