setup external ssl certs for esxi nodes

fix vcenter setup

first we need to enable custom cert management on the vcenter

vcenter > configure / settings / advanced settings
edit... (here page 93/96)

vpxd.certmgmt.mode  custom

esxi node setup

and finally you can replace the certificate

ui

node > configure / certificate
manage with external ca > import and replace

cli

cd /etc/vmware/ssl/
...

/etc/init.d/hostd restart
/etc/init.d/vpxa restart

and if that’s not enough (hint: it’s not indeed)

#services.sh restart

then you’re ready to “reconnect” from the vcenter without enforcing the ssl fingerprint

troubleshooting

fields are grayed out on esxi settings

==> fix vpxd.certmgmt.mode

resources

official

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security-8-0/securing-esxi-hosts/certificate-management-for-esxi-hosts/replacing-esxi-certificatea-intro.html ==> matching CN is required

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-security-7-0/securing-esxi-hosts/certificate-management-for-esxi-hosts/renew-esxi-certificates.html

cli

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere-sdks-tools/6-7/getting-started-with-vsphere-command-line-interfaces.html ==> see sub-menus

FW https://www.techbloat.com/how-to-install-ssl-certificate-vmware-esxi.html FW https://umatechnology.org/how-to-install-ssl-certificate-vmware-esxi/ ==> nice CLI

https://www.starwindsoftware.com/blog/how-to-replace-your-default-esxi-ssl-certificate-with-a-self-signed-certificate/ ==> restart host services

https://help.syneto.eu/en_US/vmware-esxi/how-to-replace-vmware-esxi-ssl-certificates ==> restart services

ssl mgmt

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-security-7-0/securing-esxi-hosts/certificate-management-for-esxi-hosts/replacing-esxi-certificatea-intro/replace-a-default-certificate-with-a-ca-signed-certificate-5-5-and-earlier.html ==> /etc/vmware/ssl/

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-security-7-0/securing-esxi-hosts/certificate-management-for-esxi-hosts/replacing-esxi-certificatea-intro/update-the-vcenter-server-trusted-root-store.html ==> add CAs

troubles

https://knowledge.broadcom.com/external/article/392501/manage-with-external-ca-options-are-gray.html ==> need to tune vpxd.certmgmt.mode

7.0 https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vcenter-server-upgrade-7-0/upgrading-and-updating-the-vcenter-server-appliance/preparing-to-upgrade-vcenter-server-appliance/prepare-esxi-hosts-for-vcenter-server-appliance-upgrade/change-the-certificate-mode.html 8.0 https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security-8-0/securing-esxi-hosts/certificate-management-for-esxi-hosts/change-the-certificate-mode.html ==> that’s in vcenter not esxi node settings

https://www.thegeekstuff.com/2014/10/install-ssl-cert-esxi-vcenter/ ==> esxi section

https://www.techbloat.com/how-to-install-ssl-certificate-vmware-esxi.html