Missing image

Virtual Infrastructure Navigator breaks when vCenter SSL Cert Changed

Posted by on in , , | 501 Views | 5 Responses

Like a lot of people I was quick to download and implement VMware vCenter Operations Manager 5 Enterprise when it became available. One of the great tools that is included in the suite is Virtual Infrastructure Navigator (VIN), which will discover and map all the dependencies and also DR protection status of VM’s in a linked mode group. However there is a bit of a gotcha if you want to use VIN and you also want to change the SSL Certs in vCenter and/or vSphere Web Client.

Simply put, if you install VIN prior to changing your SSL certs, it will cease to function and be completely broken. It will require that you delete the VIN instance and redeploy from scratch. Fortunately the rediscovery afterwards will fairly quickly get the inventory service mapping and dependencies back. But this is not great from an end user experience perspective. There is also no documented way to change the default self signed SSL cert on VIN itself. Given that VIN is a great tool for a secure environment to identify what services are where and connected to what I’m hoping it will work better in the future when SSL certificates are updated and that there is an easy process provided to update the VIN SSL cert.

If you want a way to fully manage the certificate lifecycle and replace certs automatically then you’ll want to check out vCert Manager – Changing VMware SSL Certs Made Easy. This will completely automate the SSL certificate process in vSphere environments. 

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2012 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

5 Responses

  1. Updating CA SSL Certificates in vSphere 5 « Long White Virtual Clouds
    Updating CA SSL Certificates in vSphere 5 « Long White Virtual Clouds at |

    […] Virtual Infrastructure Navigator breaks when vCenter SSL Cert Changed […]

  2. Nir
    Nir at |

    Thanks Michael for bringing the SSL certs to the table.

    Indeed Navigator v1.0 finds hard times in coping with SSL certs changes, however v1.1 supports that kind of SSL changes. We plan releasing v1.1 GA version very soon.

    Meantime, v1.0 customers can work around SSL certs changes by running the following procedure.

    Here is how to do this using the vCenter client:

    1. Select the VM and make sure that it is powered off

    2. Click Edit Settings

    3. Click on the vServices tab

    4. Right click on the vCenter Extension vService dependency and select Edit option

    5. For Provider choose ""

    6. Click OK

    7. Click OK

    Repeat step 2-7 where you in step 6 choose "vCenter Extension vService"

    Next time the VM is powered on it's OVF environment has been updated with the new vCenter certificate thumbprint.

    Please let me know how this works for you,

    Thanks,

    Nir Oren-Giladi

    The vCenter Infrastructure Navigator Escalation Engineering team

    Reply
    1. @vcdxnz001
      @vcdxnz001 at |

      Hi Nir, Thanks for taking the time to comment on this post. That information is very useful. Please let me know if a KB is published and I can update the article to point people to it. I look forward to seeing VIN 1.1.

      Reply
    2. @vcdxnz001
      @vcdxnz001 at |

      Hi Nir, I can confirm I've just run through this process after updating my vCenter Server Certificates and it worked great.

      Reply
  3. Nir
    Nir at |

    Thanks for the feedback Michael.

    I believe you'll be benefit from the new features and improvements we've integrated with v1.1.

    If this is OK, once we launch v2.0, I'll contact you and hopefully you'll be part of the beta program. I'll be glad to have you on board and have your feedback.

    Thanks,

    Nir

    Reply

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.