PSC HA 6.5: 3 – Preparing a certificate

Using OpenSSL we will generate a certificate signing request (.csr) and a Private Key (.key) using the configuration file completed in the previous step.

openssl req -new -nodes -out /certs/psc-ha-vip.csr -newkey rsa:2048 -keyout /certs/psc-ha-vip.key -config /certs/psc_ha_csr_cfg.cfg

The above command will output a .csr and a .key file

Note: In the above command we use rsa:2048 to create a 2048 bit key length private key. You can modify this value if you wish. For example 4096. 2048 is the minimum.

This step is only if you want to use VMCA issued certificates. If you wish to use your own Certificate Authority, skip to the next step. (Generate a certificate from an external certificate authority)

If you wish to use VMCA issued certificates (both VMCA or VMCA as a Subordinate) then we would run the following command to generate the signed certificate (.crt)

This command takes in the .csr and the the .cfg file created in earlier steps.

openssl x509 -req -days 3650 -in /certs/psc-ha-vip.csr -out /certs/psc-ha-vip.crt -CA /var/lib/vmware/vmca/root.cer -CAkey /var/lib/vmware/vmca/privatekey.pem -extensions v3_req -CAcreateserial -extfile /certs/psc_ha_csr_cfg.cfg

The above command will output a .crt file that will be the signed certificate.

Copy the current VMCA root certificate and call it cachain.crt.

cp /var/lib/vmware/vmca/root.cer /certs/cachain.crt

Create a full chained Machine SSL Certificate that contains the newly created certificate and the VMCA root certificate. Call this chained certificate psc-ha-vip-chain.crt

cat /certs/psc-ha-vip.crt >> /certs/psc-ha-vip-chain.crt
cat /certs/cachain.crt >> /certs/psc-ha-vip-chain.crt

If you do not wish to use VMCA to generate the certificate you can use your own certificate authority.

Provide the certificate signing request generated in the previous steps to your preferred certificate authority.

The following VMware KB article explains this process for a Microsoft Certificate Authority.

Obtaining vSphere certificates from a Microsoft Certificate Authority (2112014)
https://kb.vmware.com/kb/2112014

Create a full chained Machine SSL Certificate that contains the newly created certificate and all Intermediate CA(s), if applicable, and Root CA. Call this chained certificate psc-ha-vip-chain.crt

For example, in the command below I have my new certificate psc-ha-vip.crt, two Intermediate CAs CustomInterCA1.crt, CustomInterCA2.crt and finally my Root CA CustomRootCA.crt. Concatenate these certificates into a chain.

cat /certs/psc-ha-vip.crt >> /certs/psc-ha-vip-chain.crt
cat /certs/CustomInterCA1.crt >> /certs/psc-ha-vip-chain.crt
cat /certs/CustomInterCA2.crt >> /certs/psc-ha-vip-chain.crt
cat /certs/CustomRootCA.crt >> /certs/psc-ha-vip-chain.crt

Create a second chained Certificate that only contains the Intermediate CA(s), if applicable, and Root CA. Call this chained certificate cachain.crt.

cat /certs/CustomInterCA1.crt >> /certs/cachain.crt
cat /certs/CustomInterCA2.crt >> /certs/cachain.crt
cat /certs/CustomRootCA.crt >> /certs/cachain.crt

You should now have the following three files.

• psc-ha-vip-chain.crt
• psc-ha-vip.key
• cachain.crt

Run the following OpenSSL command against the psc-ha-vip-chain.crt

openssl x509 -in /certs/psc-ha-vip-chain.crt -noout -text

Verify that the Subject CN value is the correct Load Balanced FQDN.

Verify that all PSC FQDNs and Load Balanced FQDN are present in the DNS values.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d2:d0:8e:fb:89:92:59:3c
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=CA, DC=vsphere, DC=local, C=US, ST=California, O=psc-ha-a1.domain.com, OU=VMware Engineering
        Validity
            Not Before: Aug 26 10:03:00 2016 GMT
            Not After : Aug 24 10:03:00 2026 GMT
        Subject: C=IE, ST=Cork, L=Cork, O=VMware, OU=vTSU, CN=psc-ha-vip.domain.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c4:38:fc:33:24:fa:cc:7a:6d:a9:93:63:16:f4:
                    90:02:da:c6:5b:26:35:c3:b0:76:12:8f:b8:25:a2:
                    28:45:ad:7d:ea:30:e3:c2:83:cb:5a:cf:fa:36:fc:
                    e8:1e:4e:8a:4f:e0:5c:6b:94:08:f2:6f:55:fa:bd:
                    1d:84:97:a5:24:86:69:39:82:61:20:b2:e9:6e:2b:
                    61:73:6b:13:35:1f:8e:15:59:af:ee:a8:4a:bf:3c:
                    a7:91:2b:55:77:d4:37:92:2e:c2:7a:9d:51:65:f0:
                    9a:05:ab:20:4d:f2:cf:5d:16:5f:7d:df:ed:19:a0:
                    6d:f7:58:76:fa:cb:d2:44:61:3f:a7:c0:88:14:97:
                    3f:3b:6b:b0:06:02:3a:27:23:ee:79:7e:fa:63:23:
                    5c:59:d1:80:cb:7b:19:d6:cb:c9:38:f7:16:b1:ce:
                    3f:f0:c9:98:4d:2c:d6:5c:84:dc:08:50:13:f7:b8:
                    1e:57:bb:69:ed:6c:75:eb:34:a8:41:b2:b6:aa:16:
                    69:95:80:41:5e:0e:92:a8:21:12:a0:7d:bc:0c:13:
                    4b:85:54:ca:fb:11:fd:d1:e2:b6:85:54:29:17:17:
                    17:41:a4:9e:74:d3:ba:09:0c:eb:bf:fc:4e:bc:1e:
                    9e:dd:35:46:76:62:5b:ab:4f:38:7f:2a:e6:e3:0f:
                    f3:3b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Key Usage:
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Subject Alternative Name:
                DNS:psc-ha-a1.domain.com, DNS:psc-ha-a2.domain.com, DNS:psc-ha-vip.domain.com
    Signature Algorithm: sha256WithRSAEncryption
         7e:cd:c0:98:0d:72:02:ee:4b:c1:01:36:45:f7:4b:2d:a2:ee:
         9b:58:1c:fa:79:b3:b6:56:f1:8f:b3:dd:b4:5d:22:df:01:53:
         f3:56:cf:1b:c3:60:5c:30:38:de:a3:55:2d:b4:27:13:c7:6e:
         d9:0c:e6:ee:78:49:47:f5:8f:a2:e8:97:98:c2:c8:85:2a:c5:
         34:1e:c2:fa:45:5f:cb:ef:e5:51:eb:2a:62:b0:ac:75:8b:3f:
         94:f9:34:49:97:6e:eb:60:d6:d2:46:0d:15:0a:9f:06:bf:41:
         a8:53:3f:98:10:b7:37:f4:f0:43:7d:6a:28:36:db:cf:0b:95:
         cc:95:e5:7e:ac:4c:2a:00:29:53:38:3c:b5:9f:86:61:d8:e1:
         b2:71:16:fd:4c:72:a9:84:a9:fa:39:c2:47:c4:48:68:73:f8:
         ca:b8:9d:ca:56:a8:a5:36:f4:b0:1f:63:56:88:cf:5b:1d:21:
         eb:ca:c7:b5:67:14:b3:cc:d5:0a:e0:67:13:f6:44:86:ec:51:
         0e:83:fb:db:db:b9:05:fd:21:41:a4:13:95:26:60:5c:c2:77:
         a3:fa:e3:25:60:52:d4:df:f0:18:1a:4a:e1:d0:0e:3c:1b:7d:
         b2:cc:b7:bd:67:99:f3:7c:34:08:96:02:14:63:3a:6e:a3:a4:
         c8:b3:77:56