Comments on: vSphere Web Client SSL Cert not updated after vCenter SSL Cert Changed

By: @vcdxnz001

@vcdxnz001 — Wed, 04 Apr 2012 14:52:22 +0000

In reply to Dan Corrigan. Thanks Dan. I have updated the article with reference through to the VMware KB. I have not used this in the past as I don't believe it offers any additional security as the password is still contained in clear text in the configuration files. But I do acknowledge some companies security policy makes this mandatory. In a vSphere environment there are multiple tomcat instances and configuration files that would need to be updated. Not all of them are obvious, not all of the passwords are documented, and changing them is not always supported. Great care needs to be taken if you are changing from default settings. Thanks very much for the comment it is greatly appreciated.

By: Dan Corrigan

Dan Corrigan — Wed, 04 Apr 2012 13:49:54 +0000

If you have a password protected private key, you will have to edit the password used for your pfx in D:Program FilesVMwareInfrastructurevSphere Web ClientDMServerconfigtomcat-server.xml You also have to update D:Program FilesVMwareInfrastructuretomcatconfserver.xml Reference: http://kb.vmware.com/kb/1013472 BTW, Great articles!

By: Why change VMware default self-signed SSL certs? « Long White Virtual Clouds

Tue, 06 Mar 2012 09:21:48 +0000

[…] to change the self-signed SSL certs in a few of the VMware components, such as vCenter Server 5, vSphere Web Client, and ESXi 5 Hosts. All without any discussion about why you would want to do it at all. So why do […]

By: Erik Bussink

Erik Bussink — Fri, 24 Feb 2012 12:23:25 +0000

Hiya Michael,

Thanks for this great tip to also place the SSL certs in the Web Client directory.

Thanks.

By: Updating CA SSL Certificates in vSphere 5 « Long White Virtual Clouds

Updating CA SSL Certificates in vSphere 5 « Long White Virtual Clouds — Thu, 23 Feb 2012 18:53:44 +0000

[…] vSphere Web Client SSL Cert not updated after vCenter SSL Cert Changed […]

By: Behruz

Behruz — Tue, 21 Feb 2012 01:37:41 +0000

I have tried to restart system re-register vcenter 10 times and it doesn't help when I posted my frist question to you regarding Web Client I have used esxi instruction to generate certificates for vCenter and Web Client, afterwards I have realized that I have missed another instruction from you for vCenter. Today I have prepared new certificates for vCenter, Update Manager (I'm using same certificate files for Web Client from vCenter) and I'm still have problem with Web Client. I have compared thumbprint and they are the same in warning windows from Web Client and certificate itself. My another problem is the VMware vSphere Profile-Driven Storage Service fails to start.

By: @vcdxnz001

@vcdxnz001 — Sun, 19 Feb 2012 12:48:51 +0000

In reply to Behruz. Hi Behruz, I've had this before as well. The customer rebooted their system in one instance and the problem went away. Did you check that when vCenter was registered again the correct thumbprint was loaded? You should find after restarting the services, or rebooting the vSphere Web Client, that the error goes away. You may have to re-register again and double check the thumbprint is the correct one for the vCenter certificate.

By: Behruz

Behruz — Sun, 19 Feb 2012 12:17:28 +0000

Hey Michael,

thank you for great posts about certificates and their installation in vmware environment.

i have changed inventory and web client certificates and reregistered vcenter in admin-app but still have same certificate error as on your screenshot. Meanwhile certificate in the address bar is accepted by browser itself. re-registering doesn't help

any ideas?

thanks