{"id":2805,"date":"2015-05-31T15:00:22","date_gmt":"2015-05-31T05:00:22","guid":{"rendered":"https:\/\/www.penguinpunk.net\/blog\/?p=2805"},"modified":"2015-06-01T12:36:15","modified_gmt":"2015-06-01T02:36:15","slug":"vmware-vsphere-5-5-u2-workarounds-and-random-things-part-5","status":"publish","type":"post","link":"https:\/\/www.penguinpunk.net\/blog\/vmware-vsphere-5-5-u2-workarounds-and-random-things-part-5\/","title":{"rendered":"VMware \u2013 vSphere 5.5 U2 Workarounds and Random Things \u2013 Part 5"},"content":{"rendered":"<p>I&#8217;ve come across a few slightly odd things that I hadn&#8217;t accounted for during a recent vSphere 5.5 U2 deployment and thought it would be handy to document them. In this post (which is hopefully the last one)\u00a0I&#8217;d like to cover off SSL certificates.<\/p>\n<p>A lot of people don&#8217;t bother trying to deploy custom certificates because it invariably involves interaction with an in-house InfoSec team. This can be a royal pain in the arse. I understand completely. That said, getting custom certs into your vSphere environment has become a lot easier in recent times.<\/p>\n<p>Firstly, there&#8217;s a few KB articles you should read:<\/p>\n<ul>\n<li><a href=\"http:\/\/kb.vmware.com\/kb\/2057340?src=vmw_so_vex_dfrit_205\" target=\"_blank\">Deploying and using the SSL Certificate Automation Tool 5.5 (2057340)<\/a><\/li>\n<li><a href=\"http:\/\/kb.vmware.com\/kb\/2037581?src=vmw_so_vex_dfrit_205\" target=\"_blank\">Configuring CA signed SSL certificates for vSphere Update Manager in vCenter Server 5.1 and 5.5 (2037581)<\/a><\/li>\n<li><a href=\"http:\/\/kb.vmware.com\/kb\/2034833?src=vmw_so_vex_dfrit_205\" target=\"_blank\">Implementing CA signed SSL certificates with vSphere 5.x (2034833)<\/a><\/li>\n<li><a href=\"http:\/\/kb.vmware.com\/kb\/2015387?src=vmw_so_vex_dfrit_205\" target=\"_blank\">Configuring OpenSSL for installation and configuration of CA signed certificates in the vSphere environment<\/a><\/li>\n<li><a href=\"http:\/\/kb.vmware.com\/kb\/20621?src=vmw_so_vex_dfrit_205\" target=\"_blank\">Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 5.x (2062108)<\/a><\/li>\n<\/ul>\n<p>Here&#8217;s the output from the Certificate Automation Tool<\/p>\n<pre><strong>==================================================================<\/strong>\r\n<strong>Main menu\r\n\r\n<\/strong><strong>Enter the action you want to run<\/strong>\r\n<strong>\u00a0\u00a0 1. Plan your steps to update SSL certificates(Update Steps Planner)<\/strong>\r\n<strong>\u00a0\u00a0 2. Generate Certificate Signing Requests<\/strong>\r\n<strong>\u00a0\u00a0 3. Update Single Sign-On<\/strong>\r\n<strong>\u00a0\u00a0 4. Update Inventory Service<\/strong>\r\n<strong>\u00a0\u00a0 5. Update vCenter Server<\/strong>\r\n<strong>\u00a0\u00a0 6. Update vCenter Orchestrator(vCO)<\/strong>\r\n<strong>\u00a0\u00a0 7. Update vSphere Web Client and Log Browser<\/strong>\r\n<strong>\u00a0\u00a0 8. Update vSphere Update Manager(VUM)<\/strong>\r\n<strong>\u00a0\u00a0 9. End the update process and exit\r\n<\/strong><strong>The chosen action is: 1<\/strong><\/pre>\n<p>And here&#8217;s what the Update Steps Planner gives you to work through.<\/p>\n<pre><strong>The chosen action is: 1\r\n<\/strong><strong>==================================================================<\/strong>\r\n<strong>1. Plan your steps to update SSL certificates(Update Steps Planner)\r\n\r\n<\/strong><strong>Choose the services you want to update:<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 1. Single Sign-On<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 2. Inventory Service<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 3. vCenter Server<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 4. vCenter Orchestrator<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 5. vSphere Web Client<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 6. Log Browser<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 7. vSphere Update Manager<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 8. All services(listed above)<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0 9. Return to the main menu\r\n\r\n<\/strong><strong>Example:<\/strong>\r\n<strong>To choose the certificate update of Inventory Service, <\/strong><strong>vCenter Server and vSphere Web Client you would enter: 2,3,5\r\n<\/strong><strong>You chose (enter comma-separated list of numbers): 8<\/strong>\r\n<strong>Input arguments: [8]\r\n\r\n<\/strong><strong>Selected services: Single Sign-On, Inventory Service, vCenter Server, vCenter Or<\/strong><strong>chestrator, Web Client, Log Browser, vSphere Update Manager<\/strong>\r\n<strong>Detailed Plan to follow:\r\n<\/strong><strong>1. Go to the machine with Single Sign-On installed and - Update the Single Sign-<\/strong><strong>On SSL certificate.\r\n<\/strong><strong>2. Go to the machine with Inventory Service installed and - Update Inventory Ser<\/strong><strong>vice trust to Single Sign-On.\r\n<\/strong><strong>3. Go to the machine with Inventory Service installed and - Update the Inventory <\/strong><strong>Service SSL certificate.\r\n<\/strong><strong>4. Go to the machine with vCenter Server installed and - Update vCenter Server t<\/strong><strong>rust to Single Sign-On.\r\n<\/strong><strong>5. Go to the machine with vCenter Server installed and - Update the vCenter Serv<\/strong><strong>er SSL certificate.\r\n<\/strong><strong>6. Go to the machine with vCenter Server installed and - Update vCenter Server t<\/strong><strong>rust to Inventory Service.\r\n<\/strong><strong>7. Go to the machine with Inventory Service installed and - Update the Inventory <\/strong><strong>Service trust to vCenter Server.\r\n<\/strong><strong>8. Go to the machine with vCenter Orchestrator installed and - Update vCenter Or<\/strong><strong>chestrator trust to Single Sign-On.\r\n<\/strong><strong>9. Go to the machine with vCenter Orchestrator installed and - Update vCenter Or<\/strong><strong>chestrator trust to vCenter Server.\r\n<\/strong><strong>10. Go to the machine with vCenter Orchestrator installed and - Update the vCent<\/strong><strong>er Orchestrator SSL certificate.\r\n<\/strong><strong>11. Go to the machine with vSphere Web Client installed and - Update vSphere Web <\/strong><strong>Client trust to Single Sign-On.\r\n<\/strong><strong>12. Go to the machine with vSphere Web Client installed and - Update vSphere Web <\/strong><strong>Client trust to Inventory Service.\r\n<\/strong><strong>13. Go to the machine with vSphere Web Client installed and - Update vSphere Web <\/strong><strong>Client trust to vCenter Server.\r\n<\/strong><strong>14. Go to the machine with vSphere Web Client installed and - Update the vSphere <\/strong><strong>Web Client SSL certificate.\r\n<\/strong><strong>15. Go to the machine with Log Browser installed and - Update the Log Browser tr<\/strong><strong>ust to Single Sign-On.\r\n<\/strong><strong>16. Go to the machine with Log Browser installed and - Update the Log Browser SS<\/strong><strong>L certificate.\r\n<\/strong><strong>17. Go to the machine with vSphere Update Manager installed and - Update the vSp<\/strong><strong>here Update Manager SSL certificate.\r\n<\/strong><strong>18. Go to the machine with vSphere Update Manager installed and - Update vSphere <\/strong><strong>Update Manager trust to vCenter Server.<\/strong><\/pre>\n<p>And then you have a nice list of stuff to work through. I&#8217;m not going to dump the whole process here, but here&#8217;s a grab of what updating your vCenter cert looks like.<\/p>\n<pre><strong>==================================================================<\/strong>\r\n<strong>Main menu\r\n\r\n<\/strong><strong>Enter the action you want to run<\/strong>\r\n<strong>\u00a0\u00a0 1. Plan your steps to update SSL certificates(Update Steps Planner)<\/strong>\r\n<strong>\u00a0\u00a0 2. Generate Certificate Signing Requests<\/strong>\r\n<strong>\u00a0\u00a0 3. Update Single Sign-On<\/strong>\r\n<strong>\u00a0\u00a0 4. Update Inventory Service<\/strong>\r\n<strong>\u00a0\u00a0 5. Update vCenter Server<\/strong>\r\n<strong>\u00a0\u00a0 6. Update vCenter Orchestrator(vCO)<\/strong>\r\n<strong>\u00a0\u00a0 7. Update vSphere Web Client and Log Browser<\/strong>\r\n<strong>\u00a0\u00a0 8. Update vSphere Update Manager(VUM)<\/strong>\r\n<strong>\u00a0\u00a0 9. End the update process and exit\r\n\r\n<\/strong><strong>The chosen action is: 5\r\n<\/strong><strong>==================================================================\r\n<\/strong><strong>5. Update the vCenter Server SSL Certificate\r\n<\/strong><strong>\r\n     1. Update the vCenter Server Trust to Single Sign-On<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0 2. Update the vCenter Server SSL Certificate<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0 3. Update the vCenter Server Trust to Inventory Service<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0 4. Rollback to the previous vCenter Server SSL Certificate<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0 5. Return to the main menu to update other services\r\n\r\n<\/strong><strong>The chosen service is: 2<\/strong>\r\n<strong>[Thu 28\/05\/2015 - 10:39:54.86]: The services that are restarted as a part of thi<\/strong><strong>s operation are: VMware VirtualCenter Server, VMware VirtualCenter Management We<\/strong><strong>bservices and VMware vSphere Profile-Driven Storage Service.<\/strong>\r\n<strong>Enter location to the new vCenter Server SSL chain: C:\\Install\\ssl-certificate-u<\/strong><strong>pdater-tool-1308332\\vCenterServer-VC4002\\chain.pem<\/strong>\r\n<strong>Enter location to the new vCenter Server private key: C:\\Install\\ssl-certificate<\/strong><strong>-updater-tool-1308332\\vCenterServer-VC4002\\rui.key<\/strong>\r\n<strong>Enter vCenter Server administrator user name: domain\\svc_vmware<\/strong>\r\n<strong>Enter vCenter Server administrator password (will not be echoed):<\/strong>\r\n<strong>\"Important: Enter the password carefully. The Certificate Automation Update Tool <\/strong><strong>does not check the validity of the vCenter Server database password.\"<\/strong>\r\n<strong>\"A blank or incorrect password will leave the system in an inconsistent state, w<\/strong><strong>hich will cause the vCenter Server to become unavailable. \"<\/strong>\r\n<strong>\"If the system becomes unstable due to a bad password, see the Troubleshooting S<\/strong><strong>ection of KB 2041600.\"<\/strong>\r\n<strong>Enter the vCenter Server original database password (will not be echoed):<\/strong>\r\n<strong>Enter Single Sign-On Administrator user: Administrator@vsphere.local<\/strong>\r\n<strong>Enter Single Sign-On Administrator password (will not be echoed):\r\n<\/strong><strong>[.] WARNING: Certificate's `CN=VC4002.racqgroup.local, OU=vCenterServer-<\/strong><strong>VC4002, O=Company, L=Location, ST=QLD, C=AU' signature uses weak one-way h<\/strong>\r\n<strong>ash (SHA-1). In a secure environment it is recommended to use SHA2-256 or a stro<\/strong><strong>nger hash algorithm.<\/strong>\r\n<strong>[.] The supplied certificate chain is valid.<\/strong>\r\n<strong>Loading 'screen' into random state - done<\/strong>\r\n<strong>\"Restarting services... (This can take some time)\"<\/strong>\r\n<strong>\"Stopping vCenter Web Services...\"<\/strong>\r\n<strong>\"Stopping vCenter Server...\"<\/strong>\r\n<strong>\"Starting vCenter Server and other services...\"\r\n<\/strong><strong>[Thu 28\/05\/2015 - 10:45:42.32]: Last operation update vCenter Server SSL certifi<\/strong><strong>cate completed successfully.<\/strong>\r\n<strong>[Thu 28\/05\/2015 - 10:45:42.33]: Go to the next step in the plan that was receive<\/strong><strong>d from Update Steps Planner.<\/strong><\/pre>\n<p>Once you&#8217;ve had your way with vCenter, etc, you can do your ESXi hosts. The following link has info on that &#8211; <a href=\"http:\/\/kb.vmware.com\/kb\/2015499?src=vmw_so_vex_dfrit_205\" target=\"_blank\">Configuring CA signed certificates for ESXi 5.x hosts<\/a>, and you can grab the appropriate version of Win32 OpenSSL from <a href=\"http:\/\/slproweb.com\/products\/Win32OpenSSL.html\" target=\"_blank\">here<\/a>. Here&#8217;s what it looks like when you use OpenSSL to generate the requests for your ESXi hosts.<\/p>\n<pre><strong>Microsoft Windows [Version 6.1.7601]<\/strong>\r\n<strong>Copyright (c) 2009 Microsoft Corporation.\u00a0 All rights reserved.\r\n<\/strong><strong>C:\\Users\\Player1&gt;cd \\\r\n<\/strong><strong>C:\\&gt;cd OpenSSL\\bin\r\n<\/strong><strong>C:\\OpenSSL\\bin&gt;openssl req -new -nodes -out rui.csr -keyout rui-orig.key -config<\/strong>\r\n<strong>openssl.cfg<\/strong>\r\n<strong>Loading 'screen' into random state - done<\/strong>\r\n<strong>Generating a 2048 bit RSA private key<\/strong>\r\n<strong>........+++<\/strong>\r\n<strong>..........................................+++<\/strong>\r\n<strong>writing new private key to 'rui-orig.key'<\/strong>\r\n<strong>-----\r\n<\/strong><strong>C:\\OpenSSL\\bin&gt;openssl rsa -in rui-orig.key -out rui.key<\/strong>\r\n<strong>writing RSA key\r\n<\/strong><strong>C:\\OpenSSL\\bin&gt;<\/strong><\/pre>\n<p>One thing to note. I found that HA got a bit irritable until all hosts in the cluster had custom certs installed. So it&#8217;s worth turning HA off until you&#8217;re finished. If, for some reason something goes wrong wit the ESXi certs, you can re-generate the default self-signed ones with the following command:<\/p>\n<pre><strong>\/sbin\/generate-certificates<\/strong><\/pre>\n<p>&nbsp;<\/p>\n<p><strong>Updates<\/strong> In some of my previous posts, I talked about a few things that I had to do to get things working. In <a href=\"https:\/\/www.penguinpunk.net\/blog\/vmware-vsphere-5-5-u2-workarounds-and-random-things-part-1\/\" target=\"_blank\">this post<\/a>, I discussed the &#8220;Missing VMware Tools ISO&#8221;. I still don&#8217;t know why the tools files were missing from the installation, but I do know that once we applied some more recent\u00a0vSphere Update Manager baselines to those hosts the correct ISO files were added to the hosts.<\/p>\n<p>I also covered &#8220;HP Legacy BIOS Mode and ESXi&#8221; in <a href=\"https:\/\/www.penguinpunk.net\/blog\/vmware-vsphere-5-5-u2-workarounds-and-random-things-part-4\/\" target=\"_blank\">this post<\/a>. Interestingly, you&#8217;ll need to change back to UEFI BIOS mode if you&#8217;re trying to make VirtualConnect changes to a host, as my client found out the hard way.<\/p>\n<p>I also spoke about ESXi hosts and Active Directory authentication in <a href=\"https:\/\/www.penguinpunk.net\/blog\/vmware-vsphere-5-5-u2-workarounds-and-random-things-part-3\/\" target=\"_blank\">this post<\/a>. I should point out that <a href=\"http:\/\/blog.jgriffiths.org\/?p=677\" target=\"_blank\">this post<\/a> by Joseph also came in handy. If you find that when you restart the services on the host it bombs out, you&#8217;ll need to manually create \/var\/lock\/subsys. There&#8217;s a KB article from VMware that says the same thing <a href=\"http:\/\/kb.vmware.com\/kb\/2075398?src=vmw_so_vex_dfrit_205\" target=\"_blank\">here<\/a>.<\/p>\n<pre><strong>mkdir \/var\/lock\/subsys<\/strong>\r\n<strong>\/etc\/init.d\/netlogond restart<\/strong>\r\n<strong>\/etc\/init.d\/lwiod restart<\/strong>\r\n<strong>\/etc\/init.d\/lsassd restart<\/strong><\/pre>\n<p>And you should then be right.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve come across a few slightly odd things that I hadn&#8217;t accounted for during a recent vSphere 5.5 U2 deployment and thought it would be handy to document them. In this post (which is hopefully the last one)\u00a0I&#8217;d like to cover off SSL certificates. A lot of people don&#8217;t bother trying to deploy custom certificates [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54,127,4],"tags":[793,110,589,798,528,19,786,226,99,151,749],"class_list":["post-2805","post","type-post","status-publish","format-standard","hentry","category-esxi","category-vcenter","category-vmware","tag-esxi","tag-howto","tag-kb","tag-vcenter","tag-vexpert","tag-virtualisation","tag-vmware","tag-vmware-kb","tag-vmware-tools","tag-vsphere","tag-workarounds"],"_links":{"self":[{"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/posts\/2805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/comments?post=2805"}],"version-history":[{"count":20,"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/posts\/2805\/revisions"}],"predecessor-version":[{"id":2908,"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/posts\/2805\/revisions\/2908"}],"wp:attachment":[{"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/media?parent=2805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/categories?post=2805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.penguinpunk.net\/blog\/wp-json\/wp\/v2\/tags?post=2805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}