--- title: "Create SSL certificates for the External PSCs" canonical: "https://www.virtcloudrocks.com/space/VSPHTECH01/852145/Create%20SSL%20certificates%20for%20the%20External%20PSCs" format: markdown --- Scope Describe the process to create SSL certificates that will be signed by an external CA-authority, (a Microsoft based CA), that will be used by two external PSCs which will be load-balanced behind an NSX load-balancer. Create the certificate request Step 1 . Initially we need create the certificate request configuration file for the first PSC, so connect (SSH) to the primary PSC and move to root shell. Then create a new folder, eg. certs , and under that folder create a new file named  pscvip.cfg root@psc01-site-c [ ~ ]# mkdir certs root@psc01-site-c [ ~ ]# vim pscvip.cfg Then create below entries, [ req ] distinguished_name = req_distinguished_name encrypt_key = no prompt = no string_mask = nombstr req_extensions = v3_req [ v3_req ] basicConstraints = CA:false keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = DNS:psc-site-c.vmlab.local, DNS:psc01-site-c.vmlab.local, DNS:psc02-site-c.vmlab.local [ req_distinguished_name ] countryName = GR stateOrProvinceName = Patras localityName = Patras 0.organizationName = AFCOM organizationalUnitName = IT commonName = psc-site-c.vmlab.local The  subjectAltName  values should contain all PSCs FQDNs that will participate, including the Load Balanced FQDN. In our example, psc-site-c.vmlab.local → load-balanced fqdn psc01-site-c.vmlab.local → PSC01 fqdn psc02-site-c.vmlab.local → PSC02 fqdn The  commonName  value should be the load balanced FQDN. Step 2 . Run below command in order to create the certificate request and private key, $ cd certs $ openssl req -new -nodes -out pscvip.csr -newkey rsa:2048 -keyout pscvip.key -config pscvip.cfg Now you should have under the folder certs, created below files, root@psc01-site-c [ ~/certs ]# ls -la total 20 drwxr-xr-x 2 root root 4096 Jun 10 19:37 . drwx------ 4 root root 4096 Jun 10 19:34 .. -rw-r--r-- 1 root root 517 Jun 10 19:34 pscvip.cfg -rw-r--r-- 1 root root 1188 Jun 10 19:37 pscvip.csr -rw-r--r-- 1 root root 1708 Jun 10 19:37 pscvip.key Generating a certificate from an external certificate authority Here we are going to create the SSL certificate for the PSC, based on the previous certificate request; in our case we shall use a Microsoft CA, so we assume that you should have already in place a fully operational Microsoft CA. You could refer to another article that describes the process,  Configure a Windows Server 2008 R2 to act as Certificates Authority (CA) To request a certificate from Microsoft CA, we can refer to below article,  Request an SSL certificate from an MS Active Directory CA Step 1. Log in to the Microsoft CA certificate authority Web interface. By default, it is http:// CA_server_FQDN /CertSrv/. Step 2.  Click the  Request a certificate (.csr )  link. Step 3.  Click  advanced certificate request . Step 4.  Click the  Submit  button to initiate the certificate request. Step 5.  Click  Base 64 encoded  on the Certificate issued screen. Step 6.  Click the  Download Certificate  link. Step 7.  Save the certificate in a temporary file, and the copy/paste the results on a new file at PSC, under certs folder, eg. pscvip-cert.crt Step 8.  Go back to the home page of the certificate server and click  Download Certificate Chain . Make sure that you s elect the  Base 64 option . Step 9.  Save the certificate chain in a temp folder and name it certnew.p7b Step 10. Double-click the  certnew.p7b  file to open it in the Certificate Manager. Step 11. Navigate to  → Certificates . Step 12. Right-click the certificate listed and click  All Tasks →  Export . Click  Next . Step 13.  Select  Base-64 encoded X.509 (.CER) , and then click  Next, Step 14.  Save it to a temp folder with the name Root64.cer Step 15. Click Finish Prepare Certificates At that point, under the folder certs , you should have below files pscvip-cert.crt pscvip.key Root64.cer We need to create a certificate chain named  psc-vip-chain.crt , using the Root CA , and the Machine SSL Certificate that we have already created. To do so, on a command prompt, run, below commands, root@psc01-site-c [ ~/certs ]# cat pscvip-cert.crt >> pscvip-chain.crt root@psc01-site-c [ ~/certs ]# cat Root64.cer >> pscvip-chain.crt Since the CA authority does not have any other intermediate certificates, there is no need to create a CA chain. Final, below certificates should have been created, which eventually shall be used from the PSCs, pscvip-chain.crt Root64.cer pscvip.key To validate the machine SSL chain certificate, you may run below command, root@psc01-site-c [ ~/certs ]# openssl x509 -in pscvip-chain.crt -noout -text Make sure that the Subject CN has the load-balanced fqdn and that the certificate includes the FQDNs for all the external PSCs and the load-balanced VIP, as well. Update the certificate to the Platform Service Controller While being connected to the PSC, you should follow below steps to update the SSL certificates to the PSC, Step 1 . Launch the Certificate-Manager using below command, root@psc01-site-c [ ~/certs ]# /usr/lib/vmware-vmca/bin/certificate-manager Step 2 . Select option 1 → leave the default username (administrator@vsphere.local) → provide the password for the account, and then select option 2 Step 3 . Provide the requested files, where it is needed and press Enter, Step 4 . Accept the replacement of the Machine SSL certificates with the newly signed, and await for the process to finish; this should take a few minutes. Validate Replaced Certificates Option 1 Open a web browser and try to access the web interface of Primary PSC, then you shouldn't receive a security warning, and you can verify the status of certificate, Prior the aforementioned actions, to the machine on which you are accessing the web service, you need to add the Root CA certificate as Trusted Root CAs.   Option 2 Step 1. Open a web browser and try to access the web interface of Primary PSC, and login to the SSO webUI interface of the PSC. Step 2.  Go to Certificate Management  → Machine Certificates  → select the machine certificate and select Show Details , then to the pop up window you should be able to verify the details of the certificate as per the initial certificate request. Series Articles Related articles VMware KBs Configuring certificates for PSC for High Availability in vSphere 6.5 and 6.7 (2147627) Obtaining vSphere certificates from a Microsoft Certificate Authority (2112014) Related issues