While not a pretty script, I hacked together the following PowerShell to address this issue on a larger scale. Be aware that it replaces the thumbprint value in vCenter with whatever the host reports.
Connect-VIServer YOUR_VCENTER
$hosts = Get-VMHost
$spec = New-Object VMware.Vim.HostConnectSpec
$spec.Force = $True
$rspec = New-Object VMware.Vim.HostSystemReconnectSpec
Foreach ($h in $hosts) {
$hv = Get-View $h
#Read the (POSSIBLY WRONG) thumbprint from the host object in vCenter
$hostname = $h.name
Write-Host "VC says $hostname - $($hv.Summary.Config.SslThumbprint)"
#Get the current certificate from the host itself
$wr = [Net.WebRequest]::Create("https://$hostname")
#The request usually fails for one reason or another:
# untrusted (self-signed) cert or untrusted root CA are most common...
# we just want the cert info, so it usually doesn't matter
try { $response = $wr.GetResponse() }
catch{}
$t = $wr.ServicePoint.Certificate.GetCertHashString()
$spec.SslThumbprint = ([regex]::matches($t, '.{1,2}') | %{$_.value}) -join ':'
#Reconnect the host to vCenter using the 'correct' thumbprint
if($($spec.SslThumbprint) -ne $($hv.Summary.Config.SslThumbprint)) {
Write-Host "... correct host thumbprint is $($spec.SslThumbprint)"
$hv.ReconnectHost($spec,$rspec)
} else {
Write-Host " ... host agrees"
}
}
Disconnect-VIServer -confirm:$false
I hope this helps... I usually run it after I replace a batch of self-signed certificates on hosts with CA-signed certificates.
-Doug
Doug Baer, Solution Architect, Advanced Services, Broadcom | VCDX #019, vExpert 2012-23
