vcenter self signed certificate replacement process???

[scale21]

I have a client with a vcenter instance (7.0.3) that is expiring its Self Signed certs soon in 2025. Im trying to get them updated before they expire and i have a few questions. 

The Trusted Root CA has 2 instances listed one that says it expires in 2025 which it tied to an old external PSC. How do i confirm this is or is not currenlty in use? The other Root CA cert that is listed in Certificate Management doesnt expire until 11/2030 and i assume thats the one my environment is using. How do i confirm this for sure?

I suspect the second 2030 cert is from an previous upgrade of the VCSA and when our old External PSC was combined back into the VCSA as part of the upgrade at that time. 

If i can determine that this old cert is not needed and my environment is only using the newer 2030 certificate i then need to worry about the remaining certs. 

Here they are and here are their dates:

• Trusted Root CA (already covered above): 10/2025 and 11/14/2030
• STS Signing Cert: 10/2025
• VMware Cert Authority: 4/2030
• Machine Cert: 2/2025

As you can see the STS cert and the machine cert will expire in 2025. 

The system is running 7.0.3 and is at the current patch level.

Under the STS Signing Cert i can see the option to "refresh with vcenter certificate"

I believe that will update that cert to the same date as the VMware Certificate Authority date (4/2030). Is that correct?

Should i do that first and reboot as needed and then update the Machine Cert as needed by going to Actions-->Renew.....and reboot again?

Would that be all thats needed to get current with all my certs?

Questions:

1. How do i confirm my 2025 Root CA with the old PSC name is no longer in use and that the other 2030 cert is the only one being used?
2. How do i update my STS certificate? I know that 8.0 will automatically update the sts cert and i thought in that 7 you needed to run a script etc but in my case Im on the latest version of 7.0.3 i can can see a "refresh with vcenter certificate" option in the Certificate Management area of vCenter.. IM almost certain thats the path i want to take to update that to the same dates as my Vmware Certificate Authority certificate dates shown above.  (followed by a reboot of course).
3. The Machine SSL Certificate: Should this be done before the STS certificate in this case or after the STS cert has been updated? C;early i do need to update both of them soon so they will both need to be done. 
4. This particular vCenter is AD joined. IT has been since configured to use LDAPs.  Will replacing any certs affect the domain joined status or LDAPs settings or any permissions or roles on vcenter from the configured domain?  I dont think this would be affected but thought i would ask.  

My plan would be to find the answers to the questions above and then execute as follows:

1. Back up vCenter natively
2. Snapshot the vCenter VM
3. Stop any backups to avoid conflicts and issues
4. Issue the STS refresh with vCenter Cert option in the certificate manager. 
5. Wait until complete 
6. reboot vcenter
7. Login and confirm cert dates updated for the STS Cert which should match the VMware Certificate Authority cert dates
8. Using the certificate manager go to actions and renew for the machine certificate
9. wait for it to complete
10. Reboot vcenter
11. Log back into vcenter and confirm new 2+year date for the machine cert. 
12. Login to the 5480 portal and confirm everything is healthy and all services have started
13. Reconnect any items that connect to vcenter such as backups and plugins to allow them to get the new cert and continue to work as expected. 
14. Confirm everything is working as expected without any errors. Eventually clean up any outstanding snaphots once it is confirmed that all is working as expected.

Can someone please address my questions above to make sure i have the process correct?  Thanks in advance. 

[ChrisLeblanc]

Hi,

I like using a script that comes from VMWare. It's not available to the public though I did just find this. https://github.com/AngrySysOps/scripts/blob/main/vCert.sh

If you have a support agreement, you might be able to do an SR and just say you are looking for this script to help with your cert work. They may just sent you a copy. I have what I think is the latest as well from a recent SR. Happy to share.
(I suggested an SR as you would have full confidence in the source)

Fyi, in your steps, I would add step 1.5 and shutdown the VCSA before taking your snapshot. Then you are sure your DBs are in a consistent state if you need to roll back.

I will try to answer these based on my experience.

1. How do i confirm my 2025 Root CA with the old PSC name is no longer in use and that the other 2030 cert is the only one being used?
                In the tool I mentioned, you can run a report. Each cert has an id in the report, if it is used elsewhere, that ID will show up connected                 to other parts. The tool also lets you see a status of all parts so you can see other places you may need to address you may not have thought of.
   
   
2. How do i update my STS certificate? I know that 8.0 will automatically update the sts cert and i thought in that 7 you needed to run a script etc but in my case Im on the latest version of 7.0.3 i can can see a "refresh with vcenter certificate" option in the Certificate Management area of vCenter.. IM almost certain thats the path i want to take to update that to the same dates as my Vmware Certificate Authority certificate dates shown above.  (followed by a reboot of course).
              This script I mentioned has an option to replace the STS certificate. 
   
   
3. The Machine SSL Certificate: Should this be done before the STS certificate in this case or after the STS cert has been updated? C;early i do need to update both of them soon so they will both need to be done. 
               I have always done the main cert. I believe I did the STS cert after by renewing the VMCA cert.
   
   
4. This particular vCenter is AD joined. IT has been since configured to use LDAPs.  Will replacing any certs affect the domain joined status or LDAPs settings or any permissions or roles on vcenter from the configured domain?  I dont think this would be affected but thought i would ask.  
               I don't think any of mine is domain joined but we do use LDAPS. I have never seen any issues related to that.