VMware vCenter Server证书过期解决方法

目录

1.检查关键的STS证书是否过期并修复 

2.检查除STS证书外是否还有其余证书过期

3.重启服务

4.重新分配证书

1.检查关键的STS证书是否过期并修复 

检查 vCenter Server 上 STS 证书的过期日期

（参考官方：https://kb.vmware.com/s/article/79248?lang=en_us）

使用root连接VMware vCenter服务器后输入shell切换到命令行

如果可以上传checksts.py则上传后直接进行执行脚本的步骤

        创建临时目录：mkdir /temp0513

        切换进入新建目录：cd /temp0513

        编辑checksts.py:vim checksts.py

        将checksts.py中内容粘贴进去

执行脚本：python checksts.py

从结果可知STS未过期。如果STS过期，则执行修复脚本fixsts.sh（https://kb.vmware.com/s/article/76719）。执行前赋可执行权限：chmod +x fixsts.sh。运行脚本./fixsts.sh，会提示输入账户的密码。

2.检查除STS证书外是否还有其余证书过期

通过以下命令检查：

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;

从运行结果可看出，多个证书已过期。 

3.重启服务

service-control --stop --all && service-control --start –all

 等到启动超时或者在mware-vmon服务启动后中止启动。

4.重新分配证书

通过VMCA 来重新生成 vSphere 6.x （vCenter Server 的内部版本号通过shell提示符下键入“vpxd -v”查询）证书，启动 vSphere Certificate Manager。

对于vCenter Server 6.x Appliance:

/usr/lib/vmware-vmca/bin/certificate-manager

对于 Windows vCenter Server 6.x:

C:\Program Files\VMware\vCenter Server\vmcad\certificate-manager

输入“8”按提示填写，部分选项可回车直接跳过按默认值设置

着重需注意的项：

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : 不能填127.0.0.1，应写实际IP。

Enter proper value for 'Hostname' [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] :这个值和vCenter Server的主机名一致或者填IP。

Enter proper value for VMCA 'Name' :  (注意：vCenter Server 6.0 U3、6.5 及更高版本将要求提供此信息，您可以在此字段中使用 vCenter Server 的 FQDN。 它将作为 VMCA 根证书的公用名) 没有配置FQDN就使用IP地址。

执行完出现Reset status : 100% Completed [Reset completed successfully]

再访问vSphere Client可正常登录。

root@photon-machine [ /temp0513 ]# /usr/lib/vmware-vmca/bin/certificate-manager

                 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

                |                                                                     |

                |      *** Welcome to the vSphere 6.7 Certificate Manager  ***        |

                |                                                                     |

                |                   -- Select Operation --                            |

                |                                                                     |

                |      1. Replace Machine SSL certificate with Custom Certificate     |

                |                                                                     |

                |      2. Replace VMCA Root certificate with Custom Signing           |

                |         Certificate and replace all Certificates                    |

                |                                                                     |

                |      3. Replace Machine SSL certificate with VMCA Certificate       |

                |                                                                     |

                |      4. Regenerate a new VMCA Root Certificate and                  |

                |         replace all certificates                                    |

                |                                                                     |

                |      5. Replace Solution user certificates with                     |

                |         Custom Certificate                                          |

                |                                                                     |

                |      6. Replace Solution user certificates with VMCA certificates   |

                |                                                                     |

                |      7. Revert last performed operation by re-publishing old        |

                |         certificates                                                |

                |                                                                     |

                |      8. Reset all Certificates                                      |

                |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|

Note : Use Ctrl-D to exit.

Option[1 to 8]: 8

Do you wish to generate all certificates using configuration file : Option[Y/N] ? : y

Please provide valid SSO and VC privileged user credential to perform certificate operations.

Enter username [Administrator@vsphere.local]:Administrator@vsphere.local

Enter password:

Please configure certool.cfg with proper values before proceeding to next step.

Press Enter key to skip optional parameters or use Default value.

Enter proper value for 'Country' [Default value : US] : cn

Enter proper value for 'Name' [Default value : CA] :

Enter proper value for 'Organization' [Default value : VMware] :

Enter proper value for 'OrgUnit' [Default value : VMware Engineering] :

Enter proper value for 'State' [Default value : California] : Beijing

Enter proper value for 'Locality' [Default value : Palo Alto] : Beijing

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : 192.168.1.101

Enter proper value for 'Email' [Default value : email@acme.com] :

Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : photon-machine

Enter proper value for VMCA 'Name' :192.168.1.101

Continue operation : Option[Y/N] ? : y

You are going to reset by regenerating Root Certificate and replace all certificates using VMCA

Continue operation : Option[Y/N] ? : y

Get site nameCompleted [Reset Machine SSL Cert...]

default-site

Lookup all services

Get service default-site:1e430efa-1546-420b-ba83-fbddc457aeb6

Update service default-site:1e430efa-1546-420b-ba83-fbddc457aeb6; spec: /tmp/svcspec_04ml9i9_

Get service default-site:14bd50f6-95ac-4c70-a0b1-4ef46c35aad8

Update service default-site:14bd50f6-95ac-4c70-a0b1-4ef46c35aad8; spec: /tmp/svcspec_eav5shh2

Get service default-site:b6e53159-6d48-42c0-926d-720b7b852e5d

Update service default-site:b6e53159-6d48-42c0-926d-720b7b852e5d; spec: /tmp/svcspec__4eu54nw

Get service 2b573631-cd21-4f7e-af44-c5e95af4965b

Update service 2b573631-cd21-4f7e-af44-c5e95af4965b; spec: /tmp/svcspec_s3tz7vci

Get service 33e45071-803b-4fdf-a508-91668e787e95_com.vmware.vsphere.client

Don't update service 33e45071-803b-4fdf-a508-91668e787e95_com.vmware.vsphere.client

Get service f84708fd-9c9a-4535-bb8e-3e8c9f3c8c3e

Update service f84708fd-9c9a-4535-bb8e-3e8c9f3c8c3e; spec: /tmp/svcspec_7ouagxqf

Get service 33e45071-803b-4fdf-a508-91668e787e95

Update service 33e45071-803b-4fdf-a508-91668e787e95; spec: /tmp/svcspec_rgyn4426

Get service 118dacb1-c8ee-4ad2-9af6-0e6cb33f9e99

Update service 118dacb1-c8ee-4ad2-9af6-0e6cb33f9e99; spec: /tmp/svcspec_oksvwxd1

Get service 98d56b00-2eb1-4b98-a9b1-c6661c6eb8e6

Update service 98d56b00-2eb1-4b98-a9b1-c6661c6eb8e6; spec: /tmp/svcspec_w9azwaut

Get service 25055023-82e3-4303-879d-aa69a134072f

Update service 25055023-82e3-4303-879d-aa69a134072f; spec: /tmp/svcspec_2ekdtha3

Get service 9384f837-1b58-4ce3-b7fe-898b87350d2a

Update service 9384f837-1b58-4ce3-b7fe-898b87350d2a; spec: /tmp/svcspec_f9lvy5kb

Get service 4b5d2ffe-c300-4e87-b1e4-c39dde9b405c

Update service 4b5d2ffe-c300-4e87-b1e4-c39dde9b405c; spec: /tmp/svcspec_pmhip0e9

Get service 9e58c39c-6897-4e23-908e-1f67278f994f

Update service 9e58c39c-6897-4e23-908e-1f67278f994f; spec: /tmp/svcspec_vt4w3ccr

Get service 8ce6f9b5-50d6-46ad-956f-26736d8a8b05

Update service 8ce6f9b5-50d6-46ad-956f-26736d8a8b05; spec: /tmp/svcspec_peomqfj3

Get service b4b09589-8f0b-4e9a-9a47-e5d2aea29957

Update service b4b09589-8f0b-4e9a-9a47-e5d2aea29957; spec: /tmp/svcspec_83flstwn

Get service de3ef350-2ed0-4fd5-953d-6154b5ed58e2

Update service de3ef350-2ed0-4fd5-953d-6154b5ed58e2; spec: /tmp/svcspec_mp6vjit0

Get service a93c3df1-5729-495c-8e1b-47c5b4bc7d89

Update service a93c3df1-5729-495c-8e1b-47c5b4bc7d89; spec: /tmp/svcspec_2mbaphkm

Get service 6c18ec84-ffab-4590-8c07-5589157b6c69

Update service 6c18ec84-ffab-4590-8c07-5589157b6c69; spec: /tmp/svcspec_ri9y7qqi

Get service 17b2924d-34c7-4f7b-a218-b85e8544e73f

Update service 17b2924d-34c7-4f7b-a218-b85e8544e73f; spec: /tmp/svcspec_sp6qv_v_

Get service a27e854e-1aed-46d9-8e10-00bd56bb8357

Update service a27e854e-1aed-46d9-8e10-00bd56bb8357; spec: /tmp/svcspec_o7znyz2w

Get service 12d09f47-997a-43a4-a628-15bdb883bdd6_kv

Update service 12d09f47-997a-43a4-a628-15bdb883bdd6_kv; spec: /tmp/svcspec_iz8779qf

Get service c9dc859c-ffc5-435b-8874-efa9794fe197

Update service c9dc859c-ffc5-435b-8874-efa9794fe197; spec: /tmp/svcspec_mwdp0inz

Get service fb3d3e66-c58e-4dc8-8db0-0316aa439f30

Update service fb3d3e66-c58e-4dc8-8db0-0316aa439f30; spec: /tmp/svcspec_qj3vjxto

Get service 12d09f47-997a-43a4-a628-15bdb883bdd6

Update service 12d09f47-997a-43a4-a628-15bdb883bdd6; spec: /tmp/svcspec_3wz6g03m

Get service 21535e50-e4bd-421b-ac01-8eca45c23420

Update service 21535e50-e4bd-421b-ac01-8eca45c23420; spec: /tmp/svcspec_caotnowk

Get service 593ac227-54fa-4283-8716-3ded93c6e7cb

Update service 593ac227-54fa-4283-8716-3ded93c6e7cb; spec: /tmp/svcspec_85jdsili

Get service ce117814-bd0e-4bad-bd91-0ff8f243652e

Update service ce117814-bd0e-4bad-bd91-0ff8f243652e; spec: /tmp/svcspec_7celn7us

Get service 3a98f087-ede8-4285-bae6-058a91af1ff1

Update service 3a98f087-ede8-4285-bae6-058a91af1ff1; spec: /tmp/svcspec_fcxg49eg

Get service 444680a5-cb9a-4b7e-9858-fbb1b6624b5b

Update service 444680a5-cb9a-4b7e-9858-fbb1b6624b5b; spec: /tmp/svcspec_8j59l3cu

Get service e2f83ca1-b69c-4fb5-8c26-e4612e1dd8b3

Update service e2f83ca1-b69c-4fb5-8c26-e4612e1dd8b3; spec: /tmp/svcspec_umu1dhz1

Get service 6fbfc3d6-ccb2-444b-b9d3-d3509dc03e61

Update service 6fbfc3d6-ccb2-444b-b9d3-d3509dc03e61; spec: /tmp/svcspec_rw0r_wbb

Get service 42c1c1f4-6bd0-4076-951b-7d85a0bfc087

Update service 42c1c1f4-6bd0-4076-951b-7d85a0bfc087; spec: /tmp/svcspec_ehl2gcs_

Get service 0ecb83b8-cd86-4428-83a8-7eb2fe80276b

Update service 0ecb83b8-cd86-4428-83a8-7eb2fe80276b; spec: /tmp/svcspec_1ldd52l4

Get service 12d09f47-997a-43a4-a628-15bdb883bdd6_authz

Update service 12d09f47-997a-43a4-a628-15bdb883bdd6_authz; spec: /tmp/svcspec_gia5k1_4

Get service c779900e-00b2-40ac-9200-35a983584463

Update service c779900e-00b2-40ac-9200-35a983584463; spec: /tmp/svcspec_q6smxhs8

Updated 34 service(s)

Status : 60% Completed [Reset vpxd-extension Cert...]

2024-05-13T05:04:20.091Z  Updating certificate for "com.vmware.vim.eam" extension

2024-05-13T05:04:20.521Z  Updating certificate for "com.vmware.rbd" extension

2024-05-13T05:04:20.954Z  Updating certificate for "com.vmware.imagebuilder" extension

Reset status : 100% Completed [Reset completed successfully]