Lesson Learnt While Working With SSL Certificates


From last 2 days I was working on using signed certificates for my vSphere lab and was determined to replace my self-signed certificate with signed certificate generated by my CA server.

I have written a blog post on how to setup CA server and how to generate signed certificates and how to replace them. If you have missed earlier post of this series you can read them from below links:

1: Installing and Configuring CA Server

2: Creating Certificate Templates

3: Creating SSL Web Certificates Template for VMware

4: Replacing vSphere SSL Certificates

I must say this journey of learning use of signed SSL certificates were not easy for me and I did made a few mistakes before setting everything up right. But I guess it was for my own good that I made these mistakes because then I had to do a lot of troubleshooting to set things correctly and learned quite few things while doing so.

I am going to cover a few mistakes which we should avoid while working with SSL certificates:

Mistake-1: Use of SHA-1 algorithm while setting up CA Server

While I was installing CA server role there came a point where I had to select the hashing algorithm and I went with default SHA-1 as visible in below screenshot.

ssl-7

Due to this, after generating and replacing my vSphere Certificate when I was accessing the vCenter Web-Client console. it was showing that certificate has been generated by my CA server but the authenticity of website can not be verified and still the certificate was showing as red.

vcssl

Also you can see the certificate is showing warning related to use of weak SHA-1 hashing algorithm.

The reason for this was I was using google chrome and Google released a new policy some times back to degrade websites that utilize a SHA-1 Certificate in its user interface for chrome version 39.

You can read more about this from below links:

1: Google to display warnings on sites that use SHA-1 certificates

2: Google sunsetting SHA-1

How to troubleshoot this?

To counter this issue you have to change the hashing algorithm for you CA server and have to use SHA-256. This can be done by using the below commands:

# certutil -setreg ca\csp\CNGHashAlgorithm SHA256

# net stop certsvc

# net start certsvc

After this generate the certificates again and replace the certificates one more time.

Once I had followed the above steps everything worked like a charm.

vc-ssl

Mistake 2: Use of old vCenter Certificate Automation Tool

I am running vSphere v5.5 update 2d in my lab and for automating SSL certificates I downloaded the old version (1.0.x) of  Certificate Automation Tool unknowingly (may be I was very excited and did not checked the appropriate version of this tool in my sheer excitement)

Due to this when I was running the command to update my SSO SSL certificate, this tool was failing with error that it cannot find SSO service installed on my system. I was running the tool on same server where my vCenter Server (all components) was installed.

After trying for 3-4 times I was scratching my head what can be the issue as I have verified that SSO service is installed correctly on my server. After a while I googled again and found new version of this tool for vSphere 5.5.

I downloaded the new version and this time when I run the command to update SSO SSL certificates it completed without any error.

Mistake 3: Not following all the steps generated as part of action plan by Certificate Automation Tool

When you run the SSL tool for the first time it will ask you to prepare the steps needed to replace SSL certificates in right order as visible in below screenshot.

SSL-Certs (31)

I wanted to update SSL certificates for SSO, Inventory, vCenter and web-Client so this tool laid out action plan for me as below:

1. Go to the machine with Single Sign-On installed and – Update the Single Sign-On SSL certificate.

2. Go to the machine with Inventory Service installed and – Update Inventory Service trust to Single Sign-On.

3. Go to the machine with Inventory Service installed and – Update the Inventory Service SSL certificate.

4. Go to the machine with vCenter Server installed and – Update vCenter Server trust to Single Sign-On.

5. Go to the machine with vCenter Server installed and – Update the vCenter Server SSL certificate.

6. Go to the machine with vCenter Server installed and – Update vCenter Server trust to Inventory Service.

7. Go to the machine with Inventory Service installed and – Update the Inventory Service trust to vCenter Server.

8. Go to the machine with vCenter Orchestrator installed and – Update vCenter Orchestrator trust to Single Sign-On.

9. Go to the machine with vCenter Orchestrator installed and – Update vCenter Orchestrator trust to vCenter Server.

10. Go to the machine with vSphere Web Client installed and – Update vSphere Web Client trust to Single Sign-On.

11. Go to the machine with vSphere Web Client installed and – Update vSphere WebClient trust to Inventory Service.

12. Go to the machine with vSphere Web Client installed and – Update vSphere WebClient trust to vCenter Server.

13. Go to the machine with vSphere Web Client installed and – Update the vSphere Web Client SSL certificate.

14. Go to the machine with Log Browser installed and – Update the Log Browser trust to Single Sign-On.

15. Go to the machine with vSphere Update Manager installed and – Update vSphere Update Manager trust to vCenter Server.

When first time I ran this tool I missed steps 8,9,14,15 thinking that vCenter Orchestrator and Log browser service is not installed in my lab. You must say I doubted the tool for generating steps related to orchestrator and log browser. This was my mistake.

This tool is intelligent enough to produce correct steps for replacing SSL certs in a right way and we should adhere to this steps. Next time when I ran this tool again I followed all the steps generated as part of action plan and everything went well.

I guess sometimes its good we do mistakes as it teaches us a lot of other things (during researching troubleshooting steps) which are not directly related to our issue.

I hope you enjoyed reading this post. Feel free to share this on social media if it is worth sharing. Be sociable🙂

About Alex Hunt

Hi All I am Manish Kumar Jha aka Alex Hunt. I am currently working in VMware Software India Pvt Ltd as Operations System Engineer (vCloud Air Operations). I have around 5 Years of IT experience and have exposure on VMware vSphere, vCloud Director, RHEL and modern data center technologies like Cisco UCS and Cisco Nexus 1000v and NSX. If you find any post informational to you please press like and share it across social media and leave your comments if you want to discuss further on any post. Disclaimer: All the information on this website is published in good faith and for general information purpose only. I don’t make any warranties about the completeness, reliability and accuracy of this information. Any action you take upon the information you find on this blog is strictly at your own risk. The Views and opinions published on this blog are my own and not the opinions of my employer or any of the vendors of the product discussed.
This entry was posted in SSL Certficates, Vmware and tagged . Bookmark the permalink.

2 Responses to Lesson Learnt While Working With SSL Certificates

  1. Surendra M says:

    Thank you for sharing your learning experience, I wanted to learn what did you do the second time to fix the issue for step 8,9,14 & 15. As I learn that you have installed all the components in one machine you will follow step 8,9,14 & 15 but what are the steps to follow if the components are installed on different machines as in my prod environment… have installed SSO on a separate server (VM), VC and all other components in a VM, not installed vCenter Orchestrator.

    Like

    • Alex Hunt says:

      Hi Surendra,

      What I did second time was to follow all the steps which was generated as action plan by SSL Cert Automation tool.

      Now when the components are dispersed over multiple servers then you have to follow the below steps:

      1: Copy the zipped SSL Certificate Automation tool on all the servers where different components are installed. For e.g In your case you have 2 servers, one with SSO installed alone and on other server rest of the components. So you have to copy this tool on both the servers and unzip it.

      2: First go to sso server and generate request for certificate. This step I have illustrated in part-4 of this blog series.

      3: Go to server where rest of vCenter components are installed and again unzip the tool and generate request for Inventory service, vCenter Server and Web-Client

      4: Generate Action Plan for replacing SSL certs

      5: First you have to replace SSO certs. This step will be number one in the action plan list.

      From there just follow the remaining steps.

      Reach out to me if you need any assistance or face any issues or want to discuss about this more.

      Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s