• This article provides steps to regenerate certificate in "data-encipherment" VECS store on vCenter Server with a new certificate signed by the VMware Certificate Authority (VMCA).
• Certificate in "data-encipherment" store is used by VPXD Service for Guest OS Customization.

• Replace using a Shell Script
• Replace using Manual Steps (appliance)
• Replace using Manual Steps  (windows)

• Download the attached fix_encipherment_cert.sh script from this article and upload to the /tmp folder on vCenter Server.
  • If the connection to upload to the vCenter by the SCP client is rejected, run the command "chsh -s /bin/bash" to change the shell from an SSH session and retry.
  • You may also create a file using vi command and copy paste the contents of the script (eg. vi /tmp/fix_encipherment_cert.sh)
• Connect to the vCenter Server with an SSH session
• Navigate to the /tmp directory:

• Run chmod +x fix_encipherment_cert.sh to make the file executable.
• Run ./fix_encipherment_cert.sh
• Restart the VPXD service for changes to take effect, otherwise Guest OS Customizations might fail

service-control --stop vpxd
service-control --start vpxd

Important Note:

• If there are any existing Windows Customization Specifications in the vCenter database, you need to edit the Admin/Domain passwords in those Customization specifications after updating the data-encipherment Certificate. Otherwise, when using those Customization specs to customize a Windows VM, the updated Certificate could cause error saying "The public key in the specification does not match the vCenter public key. You have to reenter the password in order to proceed."
• You may also create new Windows Customization Specifications to avoid the password trouble in the existing ones.

Sample result:

• Take backup of old certificate and private key:

/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store data-encipherment --alias data-encipherment --output /tmp/old-data-encipherment.crt

/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store data-encipherment --alias data-encipherment --output /tmp/old-data-encipherment.key

• Delete the existing certificate from the VECS store:

/usr/lib/vmware-vmafd/bin/vecs-cli entry delete -y --store data-encipherment --alias data-encipherment

• List the VECS store and confirm the list is Empty:

/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store data-encipherment

• Generate a new certificate using the existing private key, and add it to the VECS store

Note:
<PSC_FQDN>
For vCenter Server 6.7 - Replace this value with the FQDN of Platform Service Controller if vCenter is running with External PSC OR use the FQDN of vCenter Server if it is embedded PSC.
For vCenter Server 7.0 - Replace this value with the VC FQDN or with "localhost"

<VC_FQDN>
Replace this value with FQDN/PNID of vCenter Server

• Verify the new certificate using below command

• Restart the VPXD service for changes to take effect, otherwise Guest OS Customizations might fail

service-control --stop vpxd
service-control --start vpxd
 

Manual Method to replace data-encipherment Certificate (windows)

• Take backup of old certificate and private key:

"%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry getcert --store data-encipherment --alias data-encipherment --output c:\tmp\old-data-encipherment.crt

"%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry getkey --store data-encipherment --alias data-encipherment --output c:\tmp\old-data-encipherment.key

• Delete the existing certificate from the VECS store:

"%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry delete -y --store data-encipherment --alias data-encipherment

• List the VECS store and confirm the list is Empty:

"%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry list --store data-encipherment

• Generate a new certificate using the existing private key, and add it to the VECS store

Note:
<PSC_FQDN>
For vCenter Server 6.7 - Replace this value with the FQDN of Platform Service Controller if vCenter is running with External PSC OR use the FQDN of vCenter Server if it is embedded PSC.
For vCenter Server 7.0 - Replace this value with the VC FQDN or with "localhost"

<VC_FQDN>
Replace this value with FQDN/PNID of vCenter Server

• Verify the new certificate using below command

• Restart the VPXD service for changes to take effect, otherwise Guest OS Customizations might fail

cd C:\Program Files\VMware\vCenter Server\bin
service-control --stop vpxd
service-control --start vpxd

• If there are any existing Windows Customization Specifications in the vCenter database, you need to edit the Admin/Domain passwords in those Customization specifications after updating the data-encipherment Certificate. Otherwise, when using those Customization specs to customize a Windows VM, the updated Certificate could cause error saying "The public key in the specification does not match the vCenter public key. You have to reenter the password in order to proceed."
• You may also create new Windows Customization Specifications to avoid the password trouble in the existing ones.
• The data-encipherment certificate is issued by VMCA root certificate. The validity term end date of new data-encipherment will be equal to the root certificate.
• The data-encipherment certificate can be updated automatically during VC upgrade in below upgrade paths:
  From 6.7x to above 70U3i(70P06)
  From 7.0x to above 8.0GA
  And in below upgrade paths, the certificate will be updated only when certificate is expired or will expire in one year to avoid extra time cost when certificate updating is unnecessary.
  From 7.0x to above 8.0U3
  From 7.0x to above 7.0P08
  From 8.0x to above 8.0U2.