Previously, I posted about certificate management in vSphere 6, which has simplified the process and provided several ways to trust certificates that will be used, while providing flexibility about what will issue the certificates to vSphere internal functionality and client facing functionality as well.
One of the simplest means to allow your clients to trust SSL certificates used by vSphere 6 is to utilize the CA functionality built into vCenter 6, and configure your clients to trust it as a Root CA, which is the focus of this blog post.
Basically, to do this, you need to obtain the root certificates of your vCenter servers, and the install them into your clients Trusted Root CA stores. Thankfully, this is a relatively straightforward and easy process.
Obtaining Root CA files for vCenter
Obtaining the root CA files for vCenter is very easy. To do this, simply connect to the FQDN of your vCenter server using HTTPS. Do not add anything after this, like you may to connect to the vSphere Web Client. For example, you would use:
https://vcentersvrname.domain.com
Once connected, you will see a link to obtain the vCenter certificates, as you can see below:
When you download this file, it will be a zip file containing two certificate files for your vCenter server. If your vCenter server is part of a linked mode installation, you will have two certificate files for every vCenter in the linked mode instance. The files with an .0 extension are the root CA files you need to import. Below, you can see the zip file downloaded from a vCenter in a two vCenter server linked mode installation.
Extract the contents of the zip file. Next, rename the .0 files with a .cer extension. This will allow the files to be easily installed within a Windows machine. You can then open them to check out the properties of the files if you like.
Installing Root CA file(s)
If you’re familiar with Windows machines, this is pretty straight forward. You would either import this file into each machine manually, or you can use a Group Policy Object, import the file(s) into it, and refresh your GPO.
That’s it! Pretty easy to do! At the very least, you should do this instead of blindly allowing the exception for the untrusted certificate every time, because we all know we aren’t checking the thumbprints of those certs to ensure we’re connecting into the same server, plus this removes the warnings if you’re not creating a permanent exception.