regnak2012
Enthusiast
Enthusiast

vCenter Virtual Appliance - Certificate Regeneration

Hi,

Our new VCSA 5.5b dumped it's SSL certificate earlier this week so I turned to the option to regenerate certificates as we are just using self signed ones. This worked fine after the reboot except for some issues around performance charts and hardware status for each Host no longer appearing. We had to reconnect each host in turn as expected. We're seeing some certificate issues in the VCSA logs and wanted to try the certificate regeneration once more but after attempting this a few times, it fails to do so. The file /etc/vmware-vpx/ssl/allow_regeneration  is being generated but after a reboot has no effect. The certs in that folder are unchanged. I tried cleaning out the ones with the name "cert.Change" at the end but this didn't help. There was a way with VCSA 5.1 to initiate a certificate change manually, this doesn't work with 5.5, does anyone know of a way to get this to work without a complete rebuild or jumping up and down and screaming?!


Thanks

Mike


Update: Ok, seems like you also HAVE to change either the IP Address or Hostname for the certificate change to kick in. I guess it's a safeguard against leaving this option set forever, it won't kick in automatically. Guess I've to change my vCenter IP or Hostname and change it back to fix this.



0 Kudos
1 Reply
FlorianBidabe
Contributor
Contributor

As per http://bidabe.zapto.org/?p=316, I would suggest to try the following :

# To roll back or generate the default certificates:

# 1a) Go to http://vcsafqdn:5480 / Admin tab / Toggle certificate regeneration / reboot the appliance.

# OR 1b) SSH -> VCSA 5.5: $ echo 'only-once' > /etc/vmware-vpx/ssl/allow_regeneration ; reboot

0 Kudos