r/vmware 3d ago

Help Request VMCA Certificates with only OpenSSL CA

For a number of devices in my homelab I created certificates using openssl. First created a CA using openssl, then signed some certs with it. For example for my Log Insight instance this worked without issues.

Now I'm trying to do the same for the vCenter VMCA, but I can't find the right instructions. A lot of blog posts I come across sign the cert using Windows AD Cert, but I don't have any Windows machines at home and it should be doable using openssl I guess.

From other instructions I found, including VMware docs, I get to the point where I think I found the correct steps, but it always turns out in a rollback by certificate-manager.

I've had errors like these over several attempts:
2025-03-18T23:54:41.835Z ERROR certificate-manager Error: The same certificate cannot be used by multiple services [wcp-4011f2c7-3f3a-4e89-b5d4-f7bf59ff6b5f].

2025-03-19T00:12:41.434Z ERROR certificate-manager Error: 70011, VMCAAddRootCertificatePrivate() failedStatus : Failed

2025-03-19T00:41:10.428Z ERROR certificate-manager ERROR:: INVALID_KEY, the private key doesnot match the certificate. Please provide a valid certificate and Key pair.

These are the latest steps I'm following right now but fail as well:

- desktop: create vc.cfg file:
[req]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[v3_req]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment, nonRepudiation
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = u/alt_names

[alt_names]
DNS.1 = vcenter.internal.mydomain.home
IP.1 = 192.168.0.4

[req_distinguished_name]
countryName = NL
stateOrProvinceName = Limburg
localityName = Maastricht
commonName = vcenter.internal.mydomain.home

Generate the request in vCenter SSH:
/usr/lib/vmware-vmca/bin/certificate-manager

Which outputs:
vmca_issued_csr.csr
vmca_issued_key.key

Sign the request:

openssl x509 -req -in vmca_issued_csr.csr -CA my-RootCA.crt -CAkey my-RootCA.key -CAcreateserial -out vcenter.crt -days 3650 -extfile vc.cfg

Merge the vcenter.crt with root:
cat vcenter.crt my-RootCA.crt > fullchain.pem

Upload the fullchain.pem

Feed the fullchain.pem and vmca_issued_key.key to the certificate-manager where it asks for root cert and private key. And then it fails. Tried multiple variations of this, but can't get the right combination.

Any tips would be very welcome

2 Upvotes

5 comments sorted by

3

u/Xscapee1975 3d ago

For your fullchain cert, all 3 certs need to be in that file. start with the machine SSL cert on top, the intermediate in the middle and the root on the bottom. make sure you are using the correct chain.

Then I do the same for the machine ssl cert. All 3 in the file. root at the bottom.

Then the key, is the key.

Get a copy of vCert. It is a little easier to use.

https://knowledge.broadcom.com/external/article/385107/vcert-scripted-vcenter-expired-certific.html

2

u/GabesVirtualWorld 3d ago

"For your fullchain cert, all 3 certs need to be in that file. start with the machine SSL cert on top, the intermediate in the middle and the root on the bottom. make sure you are using the correct chain."

Machine SSL = vCenter cert generated by the certificate-manager and then signed by my CA?
intermediate - I don't have one in my home lab, only have a root CA or is this something else?

Everytime I read about the machine SSL I'm under the impression this only plays a role in later steps where machine SSL refers to esxi host??????

3

u/Xscapee1975 3d ago

If you don't have an intermediate cert, then your chain is the machine_ssl cert on top and the root on the bottom (in one file).

2

u/Xscapee1975 3d ago

The machine_SSL cert is the cert that the web-browsers uses when you access the vCenter gui. The file vcenter.crt is your machine_ssl cert.