Users Guide

Table Of Contents
and the new certificate is the certificate after the replacement. Visit http://kb.vmware.com/selfservice/search.do?
cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=2121701 and http://kb.vmware.com/selfservice/search.do?
cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=2121689 for more information.
Updating the ssl Anchors in Windows vSphere 6.0
1. Download the lstoolutil.py.zip file from http://kb.vmware.com/selfservice/search.do?
cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=2121701.
2. Copy the lstoolutil.py file to the %VMWARE_CIS_HOME%"\VMware Identity Services\lstool\scripts\ folder.
NOTE: Do not replace the lstoolutil.py file if you are using vSphere 6.0 Update 1.
You can use the following relevant procedures to update the ssl Anchors:
Updating the ssl Anchors for vCenter installed on Windows operation system: Replace the certificates on vCenter Windows
installation by using vSphere Certificate Manager utility. See Replacing the certificates on vCenter Windows installation on
page 115.
Updating the ssl Anchors for the vCenter server appliance: Replace the certificates on vCenter server appliance by using
vSphere Certificate Manager utility. See Replacing the certificates on the vCenter server appliance on page 116.
The output obtained from the mentioned procedures should display Updated 24 service (s) and Updated 26
service (s) respectively. If the output displayed is Updated 0 service (s), the old certificate thumbprint is incorrect.
You can perform the following steps to retrieve the old certificate thumbprint. Also, use the following procedure to retrieve the
old certificate thumbprint, if vCenter Certificate Manager is not used to replace the certificates:
NOTE: Run the ls_update_certs.py with the old thumbprint obtained.
1. Retrieve the old certificate from the Managed Object Browser (MOB). See Retrieving the old certificate from Managed
Object Browser (MOB) on page 116.
2. Extract the thumbprint from the old certificate. See Extracting thumbprint from the old certificate on page 117.
Version Affected: 3.0 and later, vCenter 6.0 and later
Replacing the certificates on vCenter Windows installation
Perform the following steps if vSphere Certificate Manager utility is used to replace the certificates on vCenter Windows
installation:
1. Connect to External Platform Services Controller through remote desktop connection.
2. Open command prompt in administrative mode.
3. Create the c:\certificates folder by using the following command: mkdir c:\certificates
4. Retrieve the old certificate by using the following command: "%VMWARE_CIS_HOME%"\vmafdd\vecs-
cli entry getcert --store BACKUP_STORE --alias bkp___MACHINE_CERT --output c:
\certificates\old_machine.crt
5. Retrieve the old certificate thumbprint by using the following command: "%VMWARE_OPENSSL_BIN%" x509 -in C:
\certificates\old_machine.crt -noout -sha1 -fingerprint
NOTE:
The retrieved certificate thumbprint is in the following format: SHA1
Fingerprint=13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88
The thumbprint is a sequence of numbers and alphabets which appears as
follows:13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88
6. Retrieve the new certificate by using the following command: "%VMWARE_CIS_HOME%"\vmafdd\vecs-
cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output c:
\certificates\new_machine.crt
7. Perform the following steps:
a. Run ls_update_certs.py by using the following command. "%VMWARE _PYTHON_BIN%" ls_update_certs.py
--url
b. Replace psc.vmware.com by Lookup_Service_FQDN_of_Platform_Services_Controller and the
13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88 thumbprint with the thumbprint obtained in
step 5 by using the following command: https://psc.vmware.com/lookupservice/sdk --
fingerprint 13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88 --certfile c:
\certificates\new_machine.crt --user Administrator@vsphere.local --password Password
Troubleshooting
115