Greetings all again,
We have found a way to delete a certificate from the CA store, by debugging the VMware scripts in the folder : /usr/local/horizon/scripts
When we take a closer look to the script "manageCaCerts.inc" we can find the following function :
uninstall_ca(){
local ALIAS=$1
local FILE_ALIAS=$2
local STOREPASS=$3
local KEYSTORE=$4
local FILE_EXTENSION=$5
# have to delete the old entry if it is already there.
$JRE_KEYTOOL -delete -keystore $KEYSTORE -alias $ALIAS -storepass $STOREPASS > /dev/null 2>&1
# it also needs to be removed from here, this is a public directory of known root ca's
rm -f /etc/ssl/certs/$FILE_ALIAS.$FILE_EXTENSION
c_rehash > /dev/null
return $?
}
This can be translated to the following cli commands :
# keytool -delete -keystore /usr/local/horizon/conf/idm-cacerts -alias "CERTALIAS" -storepass "PASSWORD"
Where:
CERTALIAS : Alias of the certificate to be deleted, ex. hznext-rootca-XXXXXXXX_YYYYYY
PASSWORD is store in the file : /usr/local/horizon/conf/cakeystore.pass
Then we need to delete the corresponding certificate from the directory of the trusted certs :
# rm -f /etc/ssl/certs/hznext-rootca-XXXXXXXX_YYYYYY
restart the horizon-workspace service
# service horizon-workspace restart
We have done all this because in a lab environment we are using Let's Encrypt certificates for our public certificate.
After the change of the certificate chain of Let's Encrypt PKI, we had to remove the old expired CA (DST Root CA X3 - Expired on 30/09/2021) from our store and then import the renewed (with the new chain) public certificate to our WS1 Access.
Reference : https://community.letsencrypt.org/t/openssl-client-compatibility-changes-for-let-s-encrypt-certifica...
Unfortunately, even after the deletion of the expired CA root certificate and the import of the new Root and Intermediate certificate, WS1 Access, sees our renewed certificate chain as incomplete and does not let us import the public certificate...
PS: We have updated our Appliance to the latest version of 21.08 on which the OpenSSL version is: OpenSSL 1.0.2y-fips 16 Feb 2021
Have anyone have already ran in this problem?
Do you have any idea how to resolve this issue ?
Thank you in advance for your ideas / answers.
Regards,
WA
