{"id":15,"date":"2025-11-07T09:11:09","date_gmt":"2025-11-07T01:11:09","guid":{"rendered":"http:\/\/www.fssdlc.cn\/?p=15"},"modified":"2025-11-07T09:11:09","modified_gmt":"2025-11-07T01:11:09","slug":"vm-ssl%e8%af%81%e4%b9%a6%e5%88%b0%e6%9c%9f%e5%ae%8c%e6%95%b4%e8%bf%87%e7%a8%8b-%e6%97%a5%e5%bf%97%e8%be%93%e5%87%ba","status":"publish","type":"post","link":"https:\/\/www.fssdlc.cn\/index.php\/2025\/11\/07\/vm-ssl%e8%af%81%e4%b9%a6%e5%88%b0%e6%9c%9f%e5%ae%8c%e6%95%b4%e8%bf%87%e7%a8%8b-%e6%97%a5%e5%bf%97%e8%be%93%e5%87%ba\/","title":{"rendered":"VM SSL\u8bc1\u4e66\u5230\u671f\u5b8c\u6574\u8fc7\u7a0b-\u65e5\u5fd7\u8f93\u51fa"},"content":{"rendered":"\n

root@dmzvcsa [ \/etc\/vmware-rhttpproxy\/ssl ]# ping dmzvcsa.lcyydmz.com
PING dmzvcsa.lcyydmz.com (127.0.0.1) 56(84) bytes of data.
64 bytes from dmzvcsa.lcyydmz.com (127.0.0.1): icmp_seq=1 ttl=64 time=0.056 ms
64 bytes from dmzvcsa.lcyydmz.com (127.0.0.1): icmp_seq=2 ttl=64 time=0.052 ms
^C
— dmzvcsa.lcyydmz.com ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min\/avg\/max\/mdev = 0.052\/0.054\/0.056\/0.002 ms
root@dmzvcsa [ \/etc\/vmware-rhttpproxy\/ssl ]# cd
root@dmzvcsa [ ~ ]# cd \/usr\/lib\/vmware-vmca\/bin\/
root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]# .\/cert
certerrorvalidator certificate-manager certool
root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]# .\/certificate-manager
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.7 Certificate Manager *** |
| |
| — Select Operation — |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y\/N] ? :
Please enter any value with in [Y\/N]. : Option[Y\/N] ? : y<\/p>\n\n\n\n

Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:Traceback (most recent call last):
File “.\/certificate-manager”, line 762, in
exit(main())
File “.\/certificate-manager”, line 756, in main
parse_arguments()
File “.\/certificate-manager”, line 734, in parse_arguments
read_and_validate_password()
File “\/usr\/lib\/vmware\/site-packages\/cis\/certificateManagerOps.py”, line 367, in read_and_validate_password
password = getpass.getpass(prompt=’Enter password:’)
File “\/usr\/lib\/python3.5\/getpass.py”, line 77, in unix_getpass
passwd = raw_input(prompt, stream, input=input) File “\/usr\/lib\/python3.5\/getpass.py”, line 146, in _raw_input line = input.readline() KeyboardInterrupt root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]# .\/certificate-manager<\/em> _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.7 Certificate Manager *** |
| |
| — Select Operation — |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 4
Do you wish to generate all certificates using configuration file : Option[Y\/N] ? : Y<\/p>\n\n\n\n

Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:<\/p>\n\n\n\n

Incorrect Password! Try Again! (2 attempt\/s left)
Password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y\/N] ? : Y<\/p>\n\n\n\n

Press Enter key to skip optional parameters or use Previous value.<\/p>\n\n\n\n

Enter proper value for ‘Country’ [Previous value : US] :<\/p>\n\n\n\n

Enter proper value for ‘Name’ [Previous value : CA] :<\/p>\n\n\n\n

Enter proper value for ‘Organization’ [Previous value : VMware] :<\/p>\n\n\n\n

Enter proper value for ‘OrgUnit’ [Previous value : VMware Engineering] :<\/p>\n\n\n\n

Enter proper value for ‘State’ [Previous value : California] :<\/p>\n\n\n\n

Enter proper value for ‘Locality’ [Previous value : Palo Alto] :<\/p>\n\n\n\n

Enter proper value for ‘IPAddress’ (Provide comma separated values for multiple IP addresses) [optional] : 192.168.60.42<\/p>\n\n\n\n

Enter proper value for ‘Email’ [Previous value : email@acme.com] :<\/p>\n\n\n\n

Enter proper value for ‘Hostname’ (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : dmzvcsa.lcyydmz.com<\/p>\n\n\n\n

Enter proper value for VMCA ‘Name’ :lcyy<\/p>\n\n\n\n

You are going to regenerate Root Certificate and all other certificates using VMCA
Continue operation : Option[Y\/N] ? : Y
Get site nameCompleted [Replacing Machine SSL Cert\u2026]
default-site
Lookup all services
Get service default-site:5110e260-045a-4c6a-9bfb-d9e677b97332
Don’t update service default-site:5110e260-045a-4c6a-9bfb-d9e677b97332
Get service default-site:b8d01bf3-1bf0-4e0c-880a-34004969f817
Don’t update service default-site:b8d01bf3-1bf0-4e0c-880a-34004969f817
Get service default-site:9517a58b-9864-42f2-afbc-5ff31594748d
Don’t update service default-site:9517a58b-9864-42f2-afbc-5ff31594748d
Get service cb4da056-ec54-40fb-a128-408c279853fa
Don’t update service cb4da056-ec54-40fb-a128-408c279853fa
Get service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14_com.vmware.vsphere.client
Don’t update service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14_com.vmware.vsphere.client
Get service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14
Don’t update service 0a80f8d0-62ea-49b8-ad54-61d3e04aaf14
Get service 9fa5833c-3515-4329-9125-a9f38b0b7061
Don’t update service 9fa5833c-3515-4329-9125-a9f38b0b7061
Get service 77ed8ffb-5514-4bcb-9917-b1251f8c40b5
Don’t update service 77ed8ffb-5514-4bcb-9917-b1251f8c40b5
Get service 04996eb7-44ff-49e3-936b-71bc356fc0fd
Don’t update service 04996eb7-44ff-49e3-936b-71bc356fc0fd
Get service 67af0faa-7f8c-4291-b5a6-f76065da1544
Don’t update service 67af0faa-7f8c-4291-b5a6-f76065da1544
Get service d9d03f94-a935-4236-81d6-849d6cafe10d
Don’t update service d9d03f94-a935-4236-81d6-849d6cafe10d
Get service e1c6d612-425e-4978-b854-e43866791cb3
Don’t update service e1c6d612-425e-4978-b854-e43866791cb3
Get service d9b936d9-1f9b-4c7d-9f66-22223a279daa
Don’t update service d9b936d9-1f9b-4c7d-9f66-22223a279daa
Get service 74e86005-66bc-456c-bf53-b8bb9c53f65b
Don’t update service 74e86005-66bc-456c-bf53-b8bb9c53f65b
Get service a910ebd5-d0a3-4185-be92-e1c0a6a7baca
Don’t update service a910ebd5-d0a3-4185-be92-e1c0a6a7baca
Get service d9351b0e-13de-40bd-837b-c954b61b6ff1
Don’t update service d9351b0e-13de-40bd-837b-c954b61b6ff1
Get service e7d30769-9afd-4360-a6ce-2c45d4dff5de_kv
Don’t update service e7d30769-9afd-4360-a6ce-2c45d4dff5de_kv
Get service 298648ac-29fd-4fe8-a7ea-cb5cc4e64c0c
Don’t update service 298648ac-29fd-4fe8-a7ea-cb5cc4e64c0c
Get service e7d30769-9afd-4360-a6ce-2c45d4dff5de
Don’t update service e7d30769-9afd-4360-a6ce-2c45d4dff5de
Get service e7d30769-9afd-4360-a6ce-2c45d4dff5de_authz
Don’t update service e7d30769-9afd-4360-a6ce-2c45d4dff5de_authz
Get service 66e189de-21a7-4bbc-8e60-5027174f2cdf
Don’t update service 66e189de-21a7-4bbc-8e60-5027174f2cdf
Get service 09592aaa-287e-4e24-beaa-a25df17eaedd
Don’t update service 09592aaa-287e-4e24-beaa-a25df17eaedd
Get service c9789487-6c4b-4d34-bc85-21dc4ef284a7
Don’t update service c9789487-6c4b-4d34-bc85-21dc4ef284a7
Get service eff5228d-dd9e-4c05-91aa-14c6192fade7
Don’t update service eff5228d-dd9e-4c05-91aa-14c6192fade7
Get service d7e109da-534a-4b2a-bc13-3860f255db0d
Don’t update service d7e109da-534a-4b2a-bc13-3860f255db0d
Get service 9dc882ee-8040-47b5-80c7-8e6e1ea9a56b
Don’t update service 9dc882ee-8040-47b5-80c7-8e6e1ea9a56b
Get service ef709fcc-f8fd-4e0a-b4f0-2ad5c975a329
Don’t update service ef709fcc-f8fd-4e0a-b4f0-2ad5c975a329
Get service 59fc0d8c-0fdb-40a2-be78-b40fcd51b2fe
Don’t update service 59fc0d8c-0fdb-40a2-be78-b40fcd51b2fe
Get service 643a1131-bbe1-4d31-b541-028a68d70e95
Don’t update service 643a1131-bbe1-4d31-b541-028a68d70e95
Get service 26dcd1c8-2cd7-4249-82f5-5ceae7d21516
Don’t update service 26dcd1c8-2cd7-4249-82f5-5ceae7d21516
Get service 919318f5-8f61-4337-ab96-a682e6ae6b2d
Don’t update service 919318f5-8f61-4337-ab96-a682e6ae6b2d
Get service 974ae59c-c8ac-4153-a06c-c5b3289c60ac
Don’t update service 974ae59c-c8ac-4153-a06c-c5b3289c60ac
Get service a2814d49-80c2-4816-a2b0-a7634855c4c7
Don’t update service a2814d49-80c2-4816-a2b0-a7634855c4c7
Get service e523c4cd-2ccf-44d2-b01e-5d3d2ea5afb8
Don’t update service e523c4cd-2ccf-44d2-b01e-5d3d2ea5afb8
Get service c15d8bd8-504a-4393-8825-9765a6463af9
Don’t update service c15d8bd8-504a-4393-8825-9765a6463af9
Updated 0 service(s)
Status : 60% Completed [Replace vpxd-extension Cert\u2026]
2024-08-16T10:28:51.135Z Updating certificate for “com.vmware.vim.eam” extension<\/p>\n\n\n\n

2024-08-16T10:28:51.532Z Updating certificate for “com.vmware.rbd” extension<\/p>\n\n\n\n

2024-08-16T10:28:51.926Z Updating certificate for “com.vmware.imagebuilder” extension<\/p>\n\n\n\n

Status : 85% Completed [starting services\u2026]<\/p>\n\n\n\n

Status : 100% Completed [All tasks completed successfully]<\/p>\n\n\n\n

root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]#
root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]#
root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]# openssl s_client -connect dmzvcsa.lcyydmz.com:443 -showcerts
CONNECTED(00000003)
depth=1 CN = lcyy, DC = vsphere, DC = local, C = US, ST = California, O = dmzvcsa.lcyydmz.com, OU = VMware Engineering
verify return:1
depth=0 CN = dmzvcsa.lcyydmz.com, C = US, ST = California, L = Palo Alto, O = VMware, OU = VMware Engineering<\/p>\n\n\n\n

verify return:1<\/h2>\n\n\n\n

Certificate chain
0 s:\/CN=dmzvcsa.lcyydmz.com\/C=US\/ST=California\/L=Palo Alto\/O=VMware\/OU=VMware Engineering
i:\/CN=lcyy\/DC=vsphere\/DC=local\/C=US\/ST=California\/O=dmzvcsa.lcyydmz.com\/OU=VMware Engineering
—–BEGIN CERTIFICATE—–
MIIEbzCCA1egAwIBAgIJAP4229mP03AoMA0GCSqGSIb3DQEBCwUAMIGcMQ0wCwYD
VQQDDARsY3l5MRcwFQYKCZImiZPyLGQBGRYHdnNwaGVyZTEVMBMGCgmSJomT8ixk
ARkWBWxvY2FsMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEcMBoG
A1UECgwTZG16dmNzYS5sY3l5ZG16LmNvbTEbMBkGA1UECwwSVk13YXJlIEVuZ2lu
ZWVyaW5nMB4XDTI0MDgxNjEwMTgxMFoXDTI2MDgxNjEwMTgxMFowgYIxHDAaBgNV
BAMME2RtenZjc2EubGN5eWRtei5jb20xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApD
YWxpZm9ybmlhMRIwEAYDVQQHDAlQYWxvIEFsdG8xDzANBgNVBAoMBlZNd2FyZTEb
MBkGA1UECwwSVk13YXJlIEVuZ2luZWVyaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAt7RgGONXLq08epzk2dZFdUsjpqZsngWyoWOw1\/SMjEkFRiO+
aBXBsW0sUQAExIuq4nuVvO2greoN+hL3sKcFWvX18GCJgiC\/KF1Rp+RGYORraM\/S
KzND\/Yrdv4xnPhBn8xXfVFwYDTztgeKfwxS8pNAjvCLW4RHo3YoBdXvrYWWOpclV
PB+pZZiJAHm37h4MVu5Sxi4H+qN3zwTN18YZ20oMhixYuWVs9hQejDDVmf7E\/1lw
60mhrHycI\/644PcWy53BPrqGdBF0gDWNzZL4zDBPbhhxu7vFcYcfzRCyVx3ESKXT
P3aEEhw3+lsKor7zn0n4tFKIVFCgyOVjNgcH\/wIDAQABo4HLMIHIMAsGA1UdDwQE
AwIF4DA0BgNVHREELTArgQ5lbWFpbEBhY21lLmNvbYcEwKg8KoITZG16dmNzYS5s
Y3l5ZG16LmNvbTAdBgNVHQ4EFgQUoulUcA79l7+C+SqEyOohU3W13lcwHwYDVR0j
BBgwFoAUPu7ExGkDaJufLhlsuINtj92WyZkwQwYIKwYBBQUHAQEENzA1MDMGCCsG
AQUFBzAChidodHRwczovL2RtenZjc2EubGN5eWRtei5jb20vYWZkL3ZlY3MvY2Ew
DQYJKoZIhvcNAQELBQADggEBAGkxq0CWBZq4FTdV\/71fuGVPozMOObm9\/DeJ\/L16
eKcnA4tcfpP3T2dSSCqJ7Ob7P3UVNIhmsuDDFhmgILiZSBFIRsHADjCri6ZgzssT
SViaDV6D9C4+GI0E7vH3K99JpzbSsElUT\/62aybmm5GtECkuz17EVZyMzzYEeiRl
dzjWWTxsrVlH3VndnBIRhSBHQ\/mwatsAYN5kMbWw0Jodu9mqotUTKixu6+W9meOM
Drk2SYUMpp2mi4iTJx8ooZSK6vI3VHLr7HkTQB+F6P7J\/pGj2VRKJle1qK+LolC6
uMP43adyWukkkDN4zv6lQRlMi8xx6o\/mordgN9OIQxFR+Jk=<\/p>\n\n\n\n

—–END CERTIFICATE—–<\/h2>\n\n\n\n

Server certificate
subject=\/CN=dmzvcsa.lcyydmz.com\/C=US\/ST=California\/L=Palo Alto\/O=VMware\/OU=VMware Engineering<\/p>\n\n\n\n

issuer=\/CN=lcyy\/DC=vsphere\/DC=local\/C=US\/ST=California\/O=dmzvcsa.lcyydmz.com\/OU=VMware Engineering<\/h2>\n\n\n\n

No client certificate CA names sent
Peer signing digest: SHA512<\/p>\n\n\n\n

Server Temp Key: ECDH, P-256, 256 bits<\/h2>\n\n\n\n

SSL handshake has read 1619 bytes and written 433 bytes<\/h2>\n\n\n\n

New, TLSv1\/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: 165825F90B700F14FDD2FE503AAEFB1E30EF46DB5C11A96B626A7C90522247C7C208F00C6DC87AA68E7702DBA9463681
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1723804369
Timeout : 300 (sec)<\/p>\n\n\n\n

Verify return code: 0 (ok)<\/h2>\n\n\n\n

^C
root@dmzvcsa [ \/usr\/lib\/vmware-vmca\/bin ]# timed out waiting for input: auto-logout
Command><\/p>\n","protected":false},"excerpt":{"rendered":"

root@dmzvcsa [ \/etc\/vmware-rhttpproxy\/ssl ]# ping dmzvc…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kadence_starter_templates_imported_post":false,"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-15","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/posts\/15","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/comments?post=15"}],"version-history":[{"count":1,"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/posts\/15\/revisions"}],"predecessor-version":[{"id":16,"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/posts\/15\/revisions\/16"}],"wp:attachment":[{"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/media?parent=15"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/categories?post=15"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fssdlc.cn\/index.php\/wp-json\/wp\/v2\/tags?post=15"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}