About Certificate Generation Utility for VMware Validated Designs

The Certificate Generation Utility for VMware Validated Designs (CertGenVVD) is a command-line utility that you can use to generate custom certificates for the products that you use to build a Software-Defined Data Center (SDDC) based on VMware Validated Design for Software-Defined Data Center. Use the utility to reduce the number of steps for end-to-end certificate replacement.

CertGenVVD is written in PowerShell. It operates according to the settings in a configuration file and generates custom SSL certificates that can be signed by the following enterprise certificate authorities (CAs):

• Microsoft Certificate Authority
• OpenSSL Certificate Authority

For information about certificate replacement during SDDC deployment, see VMware Validated Design Architecture and Design and VMware Validated Design Planning and Preparation from the VMware Validated Designs Documentation.

What's new in the CertGenVVD utility?

Version 3.0.4 of the CertGenVVD utility provides the following new features:

• Support for VMware Validated Design's Consolidated design add-on
• Updates for CertConfig tool for easier configuration files creation

Supported platforms

[CERT]
NAME=default
ORG=default
OU=default
LOC=SFO
ST=default
CC=default
CN=sfo01m01vc01.sfo01.rainpole.local
keysize=default
[SAN]
sfo01m01vc01
sfo01m01vc01.sfo01.rainpole.local

Certificate Requirements

Certificate Requirements for VMware Validated Design for Software-Defined Data Center 5.0.x

• Your VMware SDDC environment requires custom SSL certificates that must be signed by a trusted third-party CA, you can use the CertGenVVD tool to generate a Certificate Signing Request (CSR) and have it signed.

Prerequisites

To run the CertGenVVD utility, you must meet specific requirements on the Windows system on which you run the utility.

• Verify that the account that you use to log in has administrative privileges.

  Although non-administrator users can download and launch the tool, all operations fail if you do not have the proper permissions.

• Verify that the Windows system has access to the data center infrastructure nodes that are designated to host the SDDC management components.
• Configure the PowerShell execution policy with the permissions required to run the commands.
  1. Run the Execute Get-ExecutionPolicy command to get the active execution policy.
  2. If the Execute Get-ExecutionPolicy command returns Restricted, run the Set-ExecutionPolicy RemoteSigned command.
• Update the default.txt file with values according to the certificate requirements of your organization.
• Update the configuration files in the ConfigFiles folder with product details if the SDDC deployment uses different hostnames and IP addresses, or requires certificate attributes different from the default ones.
  • List all hostnames under the [SAN] section in the product-specific configuration file.
  • Configure product-specific certificate attributes under the [CERT] section in the product-specific configuration file.
• Create a Microsoft Certificate Authority template, called VMware, that you use to generate the certificates for the SDDC management components. See VMware Validated Design Planning and Preparation from the VMware Validated Designs Documentation.

Install the CertGenVVD utility

1. Download the CertGenVVD tool.
2. Copy the tool to a Windows virtual machine that has access to the infrastructure nodes.
3. Extract the ZIP file to any folder and preserve the folder structure.

Use the CertGenVVD utility with VMware Validated Design

Create Configuration Files

1. Edit RegionA-Hosts.csv to match your environment. The columns descriptions are:

   Column	Description
   Name	Description of row. This will not be used in the configuration file.
   DNS*	Short names of the components. Can be added as many as necessary.
   DOMAIN	Domain name for your organization.
   IPAddress	Certain products require IP addresses in the Certificate. Use this section if necessary.
   FileName	Folder and file names of the generated configuration file. It will not affect the actual contents of the certificate.

2. Run CertConfig:

   .\CertConfig-1.1.3.ps1 RegionA-Hosts.csv

Use the CertGenVVD utility to create CA-signed certificates

1. Open a Windows PowerShell prompt as an administrator and navigate to the certgenvvd_home_dir\CertGenVVD-3.0.4 folder.
2. Run the command for generating certificates for the SDDC management components in VMware Validated Design according to the version of the CertGenVVD utility.

   .\CertGenVVD-3.0.4.ps1 -MSCASigned -attrib 'CertificateTemplate:VMware'

The certificates are signed by a Microsoft CA according to the requirements of the validated design.

The generated certificates are saved to the certgenvvd_home_dir\SignedByMSCACerts folder in multiple formats according to the certificate requirements of the SDDC management components, that is, in X.509, PEM, PKCS#12 and PKCS#7.

The CertGenVVD utility configures the certificate chain files with the password that you specified during the generation.

Use the CertGenVVD utility to create certificates that are signed by an intermediate certificate authority

.\CertGenVVD-3.0.4.ps1 -MSCASigned -attrib 'CertificateTemplate:VMware' -intermediate

Use the CertGenVVD utility to create certificate requests to a third-party CA

Certificates files that are generated for VMware Validated Design

Additional command options that are not related to certificate generation for VMware Validated Designs

The CertGenVVD utility also supports options for generating certificate-related files that do not strictly comply with VMware Validated Designs.