Replacing Machine SSL Certificate

[John Davidson]

Hi there!  We have an SSL cert issued by GoDaddy that I'm certain is SHA256: 

However, I get an error when applying this cert that it uses a weak signature algorithm and isn't supported. 

"[CERTIFICATE] Replace cert Failed: Exception found (Certificate uses a weak signature algorithm - SHA1WITHRSA. Only SHA-2 RSA algorithms are supported on the vCenter Server.)"

Has anyone else run into this issue or have any guidance for me?

[Navin A]

Hello John,

Could you please validate the Signature algorithm of the other certs in the chain? (Intermediate / root cert)

Regards,

Navin A

[John Davidson]

All certificates in the chain use the "sha256RSA" algorithm and sha256 hash as shown in the screenshot.

[Navin A]

The provided screenshot is from the Machine cert. 
The error would be seen if any cert in the chain has a SHA1. Could you please check the signature algorithm of the intermediate and root cert

[John Davidson]

I did, this is what I meant by "all certificates in the chain," but I can provide screenshots of the others if that would help confirm.

[Jonas karlsson]

Hi, I have the same problem. I think it is the thumbprint that uses sha1. 

Think we need new root-chain-certs.

/Jonas

[Jonas karlsson]

Hello,

I have the same problem. And there is a hidden cert in the chain from godaddy. Open gd_bundle-g2-g1.crt in notpad++ and you will see 3 certs. the last one is signed with sha1 :-(

[Jonas karlsson]

yes

[Jonas karlsson]

yes

[Jonas karlsson]

[John Davidson]

Oh I see what you did, you're right.... Bummer!  I'm seeing the same thing on mine as well.

[Marc Rosenthal]

Hello. How did you get around this issue? I have the same problem using InCommon (Sectigo).

[Marc Rosenthal]

For us Sectigo users, I found the solution on their site: https://www.sectigo.com/faqs/detail/VMware-Center-Certificate-does-not-accept-the-SHA-1-root-certificate/kA0Uj0000002rBV

It has to do with replacing the root cert section, which was reporting as SHA1. Once I used the solution in the link, the cert worked.

[John Lalande]

Thanks for this, Marc. This helped me fix this issue on our vCenter install. I used the certificate provided in the Sectigo article you linked to and replaced the first of three certificates in the Sectigo intermediate certificate they provide with new SSL certs ("Issuing CA certificates only: as Root/Intermediate(s) only, PEM encoded"), and was finally able to get a working SSL certificate in vCenter.

[Marc Rosenthal]

My pleasure. We've got to stick together with this stuff!