1. Back up the existing "%VMWARE_CIS_HOME%"\VMware Identity Services\lstool\scripts\lstoolutil.py file. By default, this location is C:\Program Files\VMware\vCenter Server\VMware Identity Services\lstool\scripts\.
2. Download the attached 2121701_lstoolutil.py.zip file.
3. Extract the lstoolutil.py file from the 2121701_lstoolutil.py.zip file in to "%VMWARE_CIS_HOME%"\VMware Identity Services\lstool\scripts\.

• Run this script always on the Platform Services Controller.
• To run the script, you need the thumbprint of the old vCenter Server certificate and you need the new certificate. You must upload these certificates to the Platform Services Controller before you run the script.
• Be sure to back up your existing certificates before you run the script.
• Run this script each time you replace a certificate.

Solution Overview

Task 0: Validating the sslTrust Anchors for the PSC and vCenter

1. Connect to the External Platform Services Controller using a remote desktop connection and administrator credentials.
2. Click Start > run, type cmd and press OK.

Task 1: Retrieving the Old Certificate from the Managed Object Browser (MOB)

You can retrieve the old certificate for the vCenter Server system by connecting to the Platform Service Controller using the Managed Object Browser. You must find the sslTrust field of the ArrayOfLookupServiceRegistrationInfo managed object by performing this procedure:

1. Create a directory to store the old certificates on the Platform Services Controller. For the guidance in this article, we will be using the following locations:
    

   Platform Services Controller Appliance	/certificates/
   Platform Services Controller on Windows	C:\certificates\

2. To open the MOB, go to https://psc.example.com/lookupservice/mob?moid=ServiceRegistration&method=List in a browser.
3. Log in with the [email protected] username and password when prompted for credentials.
   If you are using a custom name for your vCenter Single Sign-On domain, use that user name and password.
4. In the filterCriteria text field, modify the value field to show only the tags <filterCriteria></filterCriteria> and click Invoke Method.
   This displays the ArrayOfLookupServiceRegistrationInfo objects.
5. Search for the following depending on which certificates are replaced:
    

   vCenter Server	Search (Ctrl+F) for vc_hostname_or_IP.example.com on the page
   Platform Services Controller	Search (Ctrl+F) for psc_hostname_or_IP.example.com on the page

6. Find the value of the corresponding sslTrust field. The content of that field is the Base64 encoded string of the old certificate.
   
   Use the following examples as models when updating your Platform Services Controller or vCenter Server trust anchors.
   
   Note: The actual string was shortened significantly to improve legibility
   
   For vCenter Server:

   sslTrust	ArrayofString	MIIDfjCCAmag...
   url	anyURI	https://vcenter.vmware.local:443/sdk

   
   For Platform Services Controller:

   sslTrust	ArrayofString	MIIDfjCCAbad...
   url	anyURI	https://psc.vmware.local/sts/STSService/vsphere.local

7. Copy the content of the sslTrust field into a text document. Save this document as old_machine.txt.
8. Open the old_machine.txt in a text editor.
9. Append -----BEGIN CERTIFICATE----- to the beginning of the text string, and append -----END CERTIFICATE----- to the end of the text string. Add a carriage return after the 64th character of the contents copied from the sslTrust field.
   
   For Example:
   
   -----BEGIN CERTIFICATE-----
   LIIDeDCCAmCgAwIBAgIJAP7kGwWSSd0yMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
   PAMMAkNBMRcwFQYKCZImiZPyLGQBGRYHdnNwaGVyZTEVMBMGCgmSJomT8ixkARkW
   QWxvY2FsMQswCQYDVQQGEwJVUzEcMBoGA1UECgwTaG9tZXBzYy5mcml0ei5sb2Nh
   NDAeFw0xNTA4MTAwMDMwMjZaFw0yNTA4MDQwMDMwMjVaMCsxHDAaBgNVBAMME2hv
   HWVwc2MuZnJpdHoubG9jYWwxCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG9w0BAQEF
   LAOCAQ8AMIIBCgKCAQEAzuf/uVMLwlkUKsMXsUPigqZdrXKzEOEzOQ04q8YgVvDX
   w7MAPSTMZzeUsI6P+/4doZU14zAQTl/6dnbwYg65p9mv7CVJb4QgAJH9xFD+33Ab
   aQX7za/bWPgyxsPtccnn+si8QQDx9mMZbDzF0gjdARvpKWwVv4lln8iZ8wUahyC7
   bxnzc5/oWo4Z3DTruHMnvadHRZWzZTn8YeID06R2g8Yu5c50wXbAvNj3TE4x0Qyv
   fUbABXvv2EdYC5tb3g++L6A6tuWYgl+dr4KJ1G5gLvliECAsWsMwtQXq5nH65JdV
   XvRUVIlajC9OavGkd+ziT3yRibJBu2NJrLQp7ehgmQIDAQABo2IwYDAeBgNVHREE
   FzAVghNob21lcHNjLmZyaXR6LmxvY2FsMB0GA1UdDgQWBBSaRwv8djR7+qg7Wk3A
   zib3C3ArljAfBgNVHSMEGDAWgBRkYn4wsyRye8o14OoE3AOTMus6rzANBgkqhkiG
   9w0BAQsFAAOCAQEAU3X/ZEDXO8yDRJkjrQH0acxoc76QRDv+3s6yCpPFU8HmqU1E
   LmoDq67rHoKZw5ziBR/lGHn5oVHYYuJRFdO/b8NO1t2MnedhAaenqmAr4v0FzH6K
   UCgiLq8+ZMPFBz3qFu2i0I8mG6Yy0ud9T4wWUabgZ1C3sDNkQ+NLHXKVxNrPwgQd
   3KyrNpXgBQ0+ZWY3xvvdW5yOwnWkeAeqnGRYvzifG9M6DK/YMP1S/akAJvXSgEkJ
   PEJ3vlvSRy7l2lvU19upt4O/BAk3ZJ+X5uFtv/4GMdbEVZBCmNDS7Y85NorISiQf
   AVy/R2wjP4rNWDfN9DMCcwfPvw/0nFwrpr+0Cg==
   -----END CERTIFICATE-----
    
10. Save old_machine.txt as old_machine.crt.
11. Move or upload (via WinSCP or another SCP client) the certificate to the Platform Services Controller to the location created in Step 1:
    
    Note: SCP is disabled by default, for more information see Error when uploading files to vCenter Server Appliance using WinSCP (2107727).
     

    Platform Services Controller Appliance	/certificates/old_machine.crt
    Platform Services Controller on Windows	C:\certificates\old_machine.crt

Task 2: Extracting the Thumbprint from the Old Certificate

1. Make a remote desktop connection to the External Platform Services Controller.
2. Open an administrative command prompt.
3. Run this command to get the thumbprint:
   
   "%VMWARE_OPENSSL_BIN%" x509 -in c:\certificates\old_machine.crt -noout -sha1 -fingerprint
    
4. You see an output similar to:
   
   SHA1 Fingerprint=13:1E:60:93:E4:E6:59:31:55:EB:74:51:67:2A:99:F8:3F:04:83:88
   
   The thumbprint is the sequence of numbers and letters that follow the equal sign.

Extracting the Thumbprint Using a Certificate Viewer Tool

1. Open the file with a certificate viewer tool. In Windows, double-click the file to open it in Windows Certificate Viewer.
2. Get the SHA1 Thumbprint string. In Windows Certificate Viewer, select the SHA1 Thumbprint field.
3. Copy the thumbprint string into a plain text editor and replace the spaces with colons or remove the spaces from the string.
   
   Note: With some text editors, invisible characters are added at the beginning. Delete the first character of the thumbprint and any associated spaces, then type, not paste, the character.

Proceed to Task 3 to retrieve the new certificate.

Task 3: Retrieving the New Certificate

Depending on the replacement you are performing, you need the new vCenter Server certificate, the new Platform Services Controller certificate, or both. See Solution Overview above.

1. Log in to the vCenter Server or External Platform Services Controller Appliance through console or SSH session.
2. Run this command to enable access the Bash shell:
   
   shell.set --enabled true
    
3. Enter shell and press Enter.
4. Run this command to view the new certificate:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT –-text
    
5. Run this command to export the new certificate to a file:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /certificates/new_machine.crt
    
6. If you retrieved a vCenter Server certificate, move or upload it (via WinSCP or another SCP client) to the Platform Services Controller before you run the script.

1. Connect with remote desktop to the vCenter Server or External Platform Services Controller using administrative credentials.
2. Open an administrative command prompt.
3. Run this command to view the new certificate:
   
   "%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry list --store MACHINE_SSL_CERT --text |more
    
4. Run this command to export the new certificate to a file:
   
   "%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output c:\certificates\new_machine.crt
    
5. If you just retrieved a vCenter Server certificate, move or upload it (via WinSCP or another SCP client) to the Platform Services Controller before you run the script.

Task 4: Running the ls_update_certs.py Script

The ls_update_certs script is located at /usr/lib/vmidentity/tools/scripts/ls_update_certs.py.

1. Log in to the External Platform Services Controller Appliance through console or an SSH session.
2. Run this command to enable access the Bash shell:
   
   shell.set --enabled true
    
3. Type shell and press Enter.
4. Change directories to /usr/lib/vmidentity/tools/scripts/ with the following command:
   
   cd /usr/lib/vmidentity/tools/scripts/
    
5. Run this command:
   
   python ls_update_certs.py --url Lookup_Service_FQDN_of_Platform_Services_Controller --fingerprint Old_Certificate_Fingerprint_from_Task_2 --certfile New_Certificate_Path_from_Task_3 --user [email protected] --password "Password"
   
   For example (do not copy the fingerprint used in this example):
   
   python ls_update_certs.py --url https://psc.vmware.com/lookupservice/sdk --fingerprint 11:11:AF:D8:CF:27:6B:EF:F7:49:20:3E:D7:90:8C:F6:A0:A2:E2:30 --certfile /certificates/new_machine.crt --user [email protected] --password "Password"

1. Make a remote desktop connection to the External Platform Services Controller.
2. Open an administrative command prompt