Users Guide
The thumbprint is a sequence of numbers and alphabets which appears as
follows:13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88
6. Retrieve the new certificate by using the following command: "%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry getcert
--store MACHINE_SSL_CERT --alias __MACHINE_CERT --output c:\certificates\new_machine.crt
7. Perform the following steps:
a. Run ls_update_certs.py by using the following command. "%VMWARE _PYTHON_BIN%" ls_update_certs.py --
url
b. Replace psc.vmware.com by Lookup_Service_FQDN_of_Platform_Services_Controller and the
13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88 thumbprint with the thumbprint obtained in step 5 by using the
following command: https://psc.vmware.com/lookupservice/sdk --fingerprint
13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88 --certfile c:\certificates
\new_machine.crt --user Administrator@vsphere.local --password Password
NOTE: Ensure to provide valid credentials.
8. Log out and log in to the vCenter Web client after all the services are updated successfully.
OMIVV now launches successfully.
Replacing the certificates on the vCenter server appliance
Perform the following steps if vSphere Certificate Manager utility is used to replace the certificates on the vCenter server appliance:
1. Log in to the External Platform Services Controller appliance through console or a secure shell (SSH) session.
2. Run the following command to enable accessing the Bash shell: shell.set --enabled true
3. Type shell and press Enter.
4. Create folders or certificates by using the following command: mkdir /certificates
5. Retrieve the old certificate by using the following command: /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --
store BACKUP_STORE --alias bkp___MACHINE_CERT --output /certificates/old_machine.crt
6. Retrieve the old certificate thumbprint by using the following command: openssl x509 -in /certificates/
old_machine.crt -noout -sha1 -fingerprint
NOTE:
The retrieved certificate thumbprint is in the following format: SHA1
Fingerprint=13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88
The thumbprint is a sequence of numbers and alphabets which appears as
follows:13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88
7. Retrieve the new certificate by using the following command:/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --
store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /certificates/new_machine.crt
8. Run the following command to change the directory: cd /usr/lib/vmidentity/tools/scripts/
9. Perform the following steps:
a. Run ls_update_certs.py by using the following command. python ls_update_certs.py --url
b. Replace psc.vmware.com by Lookup_Service_FQDN_of_Platform_Services_Controller and the
13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88 thumbprint with the thumbprint obtained in step 6 by using the
following command: https://psc.vmware.com/lookupservice/sdk --fingerprint
13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88 --certfile /certificates/
new_machine.crt --user Administrator@vsphere.local --password "Password"
NOTE: Ensure to provide valid credentials.
10. Log out and log in to the vCenter Web client after all the services are updated successfully.
OMIVV now launches successfully.
Retrieving the old certificate from Managed Object Browser-MOB
You can retrieve the old certificate for the vCenter server system by connecting to Platform Service Controller (PSC) by using the
Managed Object Browser (MOB).
To retrieve the old certificate, you should find the sslTrust field of the ArrayOfLookupServiceRegistrationInfo managed object by
performing the following steps:
NOTE: In this guide, the C:\certificates\ folder location is used to store all certificates.
Frequently Asked Questions-FAQ 139