vCenter SSL 인증서 만료 문제

vCenter 관리 > 인증서 > 인증서관리 에 들어가면 아래 인증서들이 있다.

 

시스템 SSL 인증서

솔루션 인증서

신뢰할 수 있는 루트 인증서

 

ESXi 6.5 기준 인증서 유효기간이 2~3년이며,

인증서 만료되기 전 작업 > 갱신 해주면 해결되는데 문제는 알람이...없... 경고는 뜰건데 vCenter를 접속해서 봐야 한다.

갱신하면 2년 주기로 갱신 됨.

버튼만 클릭하면 끝나 쉬워!

대신 hostname/FQDN 입력하는 란에 localhost 쓰면 안됨(ip나 도메인을 쓸 것)

 

문제는...

 

갱신을 못하고 넘겨버릴 경우

vCenter 로그인이 안됨(좆된거임)

 

로그인이 안되면

VMware에서 fixsts.sh 다운로드 받아서 실행

"Signing certificate is not valid" error in VCSA 6.5.x/6.7.x and vCenter Server 7.0.x (76719) (vmware.com)

[ /tmp ]# ./fixsts.sh (인증서 재생성 스크립트로 VC의 administrator 계정 정보 입력 필요)
NOTE: This works on external and embedded PSCs
This script will do the following
1: Regenerate STS certificate
What is needed?
1: Offline snapshots of VCs/PSCs
2: SSO Admin Password

=== 생략 ===

 

 

 VC에서 인증정보 Reset 수행 아래 내용 참고, VC 서비스가 reset이 발생하기 때문에 vmware fence 구성된 서버들은 주의 필요

[ ~ ]# /usr/lib/vmware-vmca/bin/certificate-manager (VC 인증 관리자 실행)
                 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
                |                                                                     |
                |      *** Welcome to the vSphere 6.5 Certificate Manager  ***        |
                |                                                                     |
                |                   -- Select Operation --                            |
                |                                                                     |
                |      1. Replace Machine SSL certificate with Custom Certificate     |
                |                                                                     |
                |      2. Replace VMCA Root certificate with Custom Signing           |
                |         Certificate and replace all Certificates                    |
                |                                                                     |
                |      3. Replace Machine SSL certificate with VMCA Certificate       |
                |                                                                     |
                |      4. Regenerate a new VMCA Root Certificate and                  |
                |         replace all certificates                                    |
                |                                                                     |
                |      5. Replace Solution user certificates with                     |
                |         Custom Certificate                                          |
                |                                                                     |
                |      6. Replace Solution user certificates with VMCA certificates   |
                |                                                                     |
                |      7. Revert last performed operation by re-publishing old        |
                |         certificates                                                |
                |                                                                     |
                |      8. Reset all Certificates                                      |
                |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : Y

Please provide valid SSO and VC priviledged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]: VC 계정
Enter password: VC administrator 계정 암호

Please configure certool.cfg with proper values before proceeding to next step.

Press Enter key to skip optional parameters or use Default value.

Enter proper value for 'Country' [Default value : US] : Enter

Enter proper value for 'Name' [Default value : CA] :Enter

Enter proper value for 'Organization' [Default value : VMware] :Enter

Enter proper value for 'OrgUnit' [Default value : VMware Engineering] :Enter

Enter proper value for 'State' [Default value : California] :Enter

Enter proper value for 'Locality' [Default value : Palo Alto] :Enter

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] :Enter

Enter proper value for 'Email' [Default value : email@acme.com] :Enter

Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : ip or FQDN

Enter proper value for VMCA 'Name' : ip
Continue operation : Option[Y/N] ? : Y

You are going to reset by regenerating Root Certificate and replace all certificates using VMCA
Continue operation : Option[Y/N] ? : Y
Get site nameCompleted [Reset Machine SSL Cert...]

=== 생략 ===

 

이게 될때도 있고 안될 때도 있다.

안되면 재설치...

 

인증서 만료가 안돼서 갱신할 수 있는 상황이면 순식간에 끝나니까 

굳이 Pacemaker 서버들 찾아서 maintenance mode로 안바꿔줘도 된다. 불안하면 해주든가.