1. Connect to VMware vCenter Server Appliance 6.0 as root through a console or SSH session.
2. Run this command to create a temporary directory to store files during generation:
   
   mkdir /ssl
    
3. Using a text editor, open the /usr/lib/vmware-vmca/share/config/certool.cfg file and provide the custom details pertaining to your environment and save the file.
   
   Note: It is important to ensure that hostname is correct. The IP address value is optional.
    
4. Run this command to generate a new private and public key for the Lookup Service:
   
   /usr/lib/vmware-vmca/bin/certool --server localhost --genkey --privkey=/ssl/ssoserver.key --pubkey=/ssl/ssoserver.pub
    
5. Run this command to generate a new certificate for the Lookup Service using the previously generated private key and certool.cfg file:
   
   /usr/lib/vmware-vmca/bin/certool --gencert --cert=/ssl/ssoserver.cer --privkey=/ssl/ssoserver.key --config=/usr/lib/vmware-vmca/share/config/certool.cfg
   
   Note: If you are using External CA as your certificate authority: run /usr/lib/vmware-vmca/bin/certool --initcsr --privkey=/ssl/ssoserver.key --pubkey=/ssl/ssoserver.pub --csrfile=/ssl/ssoserver.csr --config=/usr/lib/vmware-vmca/share/config/certool.cfg and get the generated ssoserver.csr signed by your Enterprise CA.
    
6. Run this command to generate a .p12 file consisting of both the ssoserver.cer and ssoserver.key file:
   
   openssl pkcs12 -export -in /ssl/ssoserver.cer -inkey /ssl/ssoserver.key -name "ssoserver" -passout pass:changeme -out /ssl/ssoserver.p12
   
   Note: Do not modify the -passout value. This must remain as changeme.
    
7. Run this command to backup the existing ssoserver.p12 file:
   
   cp /usr/lib/vmware-sso/vmware-sts/conf/ssoserver.p12 /usr/lib/vmware-sso/vmware-sts/conf/ssoserver.p12.backup
    
8. Run this command to replace the old ssoserver.p12 file with the newly generated ssoserver.p12 file:
   
   cp /ssl/ssoserver.p12 /usr/lib/vmware-sso/vmware-sts/conf/ssoserver.p12
    
9. In a environment that is running vCenter Server 5.5 and the new lookup service CA certificate is different from the old lookup service certificate, run these steps:
    
   1. Run this command to update the SSO endpoints on port 7444 with the CA certificate of the new lookup service certificate.
      
      python ls_update_certs.py --url https://FQDN_of_Platform_Services_Controller/lookupservice/sdk --fingerprint Old_Certificate_Fingerprint --certfile New_CA_Certificate_Path --user [email protected] --password "Password"
      
      For example:
      
      python ls_update_certs.py --url https://psc.vmware.com/lookupservice/sdk --fingerprint 43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8 --certfile /certs/cert.crt --user [email protected] --password "Password"
   2. Update the <PATH> on vCenter Server 5.5 with the CA certificate of the new lookup service certificate.
       
   3. Run these commands to restart the vCenter Server 5.5 services.
      
      service-control --stop --all
      service-control --start --all
10. Run these commands to restart the Platform Services Controller services:
    
    Note: If the Platform Services Controller is external from VMware vCenter Server, restart the services on all VMware vCenter Server machines registered with the Platform Services Controller.
    
    For more information, see:
    • Stopping, starting, or restarting VMware vCenter Server 6.0 services (2109881)
    • Stopping, starting, or restarting VMware vCenter Server Appliance 6.0 services (2109887)
      
      service-control --stop --all
      service-control --start --all

VMware vCenter Server installed on a Microsoft Windows Server

1. Log in as an administrator to the Microsoft Windows Server with the Platform Services Controller installed.
2. Open an elevated command prompt.
3. Run this command to create a temporary directory to store files during generation:
   
   C:\> mkdir C:\ssl
    
4. Using a text editor, open the C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg file and provide the custom details pertaining to your environment and save the file.
   
   Note: VMware recommends using Microsoft Notepad.
   
   Run this command to open the file using a Notepad:
   
   C:\> notepad "C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg"
   
   Note: It is important to ensure that hostname is correct. The IP address value is optional.
    
5. Run this command to generate a new private and public key for the Lookup Service:
   
   C:\> "C:\Program Files\VMware\vCenter Server\vmcad\certool.exe" --server localhost --genkey --privkey=C:\ssl\ssoserver.key --pubkey=C:\ssl\ssoserver.pub
    
6. Run this command to generate a new certificate for the Lookup Service using the previously generated private key and certool.cfg file:
   
   C:\> "C:\Program Files\VMware\vCenter Server\vmcad\certool.exe" --gencert --cert=C:\ssl\ssoserver.cer --privkey=C:\ssl\ssoserver.key --config="C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg"
   
   Note: If you are using external CA as your certificate authority: run C:\> "C:\Program Files\VMware\vCenter Server\vmcad\certool.exe" --initcsr --privkey=C:\ssl\ssoserver.key --pubkey=C:\ssl\ssoserver.pub --csrfile=C:\ssl\ssoserver.csr --config="C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg" and get the generated ssoserver.csr signed by your Enterprise CA.
    
7. Run this command to generate a .p12 file consisting of both the ssoserver.cer and ssoserver.key file:
   
   C:\> "C:\Program Files\VMware\vCenter Server\openSSL\openssl.exe" pkcs12 -export -in C:\ssl\ssoserver.cer -inkey C:\ssl\ssoserver.key -name "ssoserver" -passout pass:changeme -out C:\ssl\ssoserver.p12
   
   Note: Do not modify the -passout value. This must remain as changeme .
    
8. Run this command to backup the existing ssoserver.p12 file:
   
   C:\> copy "C:\ProgramData\VMware\vCenterServer\runtime\VMwareSTSService\conf\ssoserver.p12" "C:\ProgramData\VMware\vCenterServer\runtime\VMwareSTSService\conf\ssoserver.p12.backup"
    
9. Run this command to replace the old ssoserver.p12 with the newly generated ssoserver.p12 file:
   
   C:\> copy "C:\ssl\ssoserver.p12" "C:\ProgramData\VMware\vCenterServer\runtime\VMwareSTSService\conf\ssoserver.p12"
    
10. In a environment that is running vCenter Server 5.5 and the new lookup service CA certificate is different from the old lookup service certificate, run these steps:
     
    1. Run this command to update the SSO endpoints on port 7444 with the CA certificate of the new lookup service certificate.
       
       python ls_update_certs.py --url https://FQDN_of_Platform_Services_Controller/lookupservice/sdk --fingerprint Old_Certificate_Fingerprint --certfile New_CA_Certificate_Path --user [email protected] --password "Password"
       
       For example:
       
       python ls_update_certs.py --url https://psc.vmware.com/lookupservice/sdk --fingerprint 43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8 --certfile /certs/cert.crt --user [email protected] --password "Password"
    2. Update the C:\ProgramData\VMware\SSL\ca_certificates.crt on vCenter Server 5.5 with the CA certificate of the new lookup service certificate.
        
    3. Run these commands to restart the vCenter Server 5.5 services.
       
       C:\>"C:\Program Files\VMware\vCenter Server\bin\service-control.bat" --stop --all
       C:\> "C:\Program Files\VMware\vCenter Server\bin\service-control.bat" --start --all
11. Run these commands to restart the Platform Services Controller services:
    
    C:\>"C:\Program Files\VMware\vCenter Server\bin\service-control.bat" --stop --all
    C:\>"C:\Program Files\VMware\vCenter Server\bin\service-control.bat" --start --all
    
    Note: If the Platform Services Controller is external from vCenter Server, restart the services on all vCenter Server machines registered with the Platform Services Controller.
    
    For more information, see: