This is mostly a note to myself.
Venafi TPP can copy certificate files via SSH by using SCP.
Look like ESXi supports this:
- I've always WinSCP'd into the host then gone to /etc/vmware/ssl/ rename and transfer the certificate as 'rui.crt' and rename and transfer the private key as 'rui.key' then go to the ESXi console, go to troubleshoot, and restart management agents. Your ESXi host should now be using the new certificates.
- https://www.reddit.com/r/vmware/comments/yenv8d/replace_esxi_host_ssl_with_internal_ca_with/
Other:
- https://knowledge.broadcom.com/external/article?legacyId=56441
- https://www.filecloud.com/blog/2022/06/installing-an-ssl-certificate-on-an-esxi-server/
- https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-B70177EE-9C62-4BB9-BD3C-4848C128E63A.html
- https://www.starwindsoftware.com/blog/how-to-replace-your-default-esxi-ssl-certificate-with-a-self-signed-certificate/
- https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-admin/GUID-91824B56-91F3-44FE-B67B-180A50B94717.html#GUID-91824B56-91F3-44FE-B67B-180A50B94717
Great post! I’ve been using WinSCP to replace ESXi certificates for years. Curious—do you think Venafi TPP could fully automate this process, or is manual intervention always required?
ReplyDeleteSlotted Angle rack delhi
Warehouse storage rack delhi
Nice! I usually struggle with managing SSL certificates on ESXi hosts. This looks like a cleaner process. Have you tried automating the agent restart as well?
ReplyDeleteHeavy duty pallet rack delhi
Pallet storage rack india
Solid tip! Managing SSL certificates manually can be tedious. I'll check out Venafi TPP now. Do you recommend any particular tool for monitoring certificate expiry on ESXi?
ReplyDeleteIndustrial Pallet Racks india
Spare part storage rack india
I always forget the /etc/vmware/ssl/ path! This note will come in handy. A script to automate SCP transfers and restarts would be awesome—any plans to create one?
ReplyDeleteHeavy Duty Rack
warehouse racking system
I followed the steps in the VMware docs you linked, but I hit issues with permissions. Did you encounter anything similar while using WinSCP for updates?
ReplyDeleteCantilever rack india
long span rack india
It’s great to see someone break down certificate updates for ESXi. This seems much simpler than the other tutorials I’ve come across. Thanks for sharing!
ReplyDeleteMezzanine floor noida
Slotted Angle racks noida
Out of curiosity, what internal CA are you using? I’ve been looking into alternatives like Let’s Encrypt but wasn’t sure how well it integrates with ESXi.
ReplyDeletePallet storage rack noida
Warehouse Pallet Racking System noida
Good read! I’ve seen a few admins overlook SSL certificates in their ESXi hosts. This post highlights why it’s crucial. Do you update certificates on a fixed schedule?
ReplyDeleteSpare part storage rack noida
Pallet Rack Lucknow