Search the VMware Knowledge Base (KB)
View by Article ID

Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 6.0 (2112009)

  • 22 Ratings

Purpose

This article provides information on configuring Microsoft Certificate Authority (CA) templates for use with custom SSL certificate implementation in vSphere 6.0.

For more information on vSphere 5.x versions, see Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 5.x (2062108)

Resolution



Creating a new template for vSphere 6.0 to use for Machine SSL and Solution User certificates
  1. Connecting to the CA server, you will be generating the certificates from through an RDP session.
  2. Click Start > Run, type certtmpl.msc, and click OK
  3. In the Certificate Template Console, under Template Display Name, right-click Web Server and click Duplicate Template.
  4. In the Duplicate Template window, select Windows Server 2003 Enterprise for backward compatibility. 

    Note: If you have an encryption level higher than SHA1, select Windows Server 2008 Enterprise.

  5. Click the General tab.
  6. In the Template display name field, enter vSphere 6.0 as the name of the new template.
  7. Click the Extensions tab.
  8. Select Application Policies and click Edit.
  9. Select Server Authentication and click Remove, then OK.

    Note: If Client Authentication exists, remove this from Application Policies as well.

  10. Select Key Usage and click Edit.
  11. Select the Signature is proof of origin (nonrepudiation) option. Leave all other options as default.
  12. Click OK.
  13. Click the Subject Name tab.
  14. Ensure that the Supply in the request option is selected.
  15. Click OK to save the template.
  16. Proceed to Adding a new template to certificate templates section in the article to make the newly created certificate template available.
Creating a new template for vSphere 6.0 to use for VMCA as a Subordinate CA
  1. Connecting to the CA server, you will be generating the certificates from through an RDP session.
  2. Click Start > Run, type certtmpl.msc, and click OK.
  3. In the Certificate Template Console, under Template Display Name, right-click Subordinate Certificate Authority and click Duplicate Template.
  4. In the Duplicate Template window, select Windows Server 2003 Enterprise for backward compatibility. 

    Note: If you have an encryption level higher than SHA1, select Windows Server 2008 Enterprise.

  5. Click the General tab.
  6. In the Template display name field, enter vSphere 6.0 VMCA as the name of the new template.
  7. Ensure Publish certificate in Active Directory is selected.
  8. Click the Extensions tab.
  9. Select Key Usage and click Edit.
  10. Ensure that Digital Signature, Certificate signing and CRL signing are enabled.
  11. Ensure that Make this extension critical is enabled.
  12. Click OK.
  13. Click OK to save the template.
  14. Proceed to Adding a new template to certificate templates section in the article to make the newly created certificate template available.
Adding a new template to certificate templates
  1. Connecting to the CA server, you will be generating the certificates from through an RDP session.
  2. Click Start > Run, type certsrv.msc, and click OK
  3. In the left pane of the Certificate Console, if collapsed, expand the node by clicking the + icon.
  4. Right-click Certificate Templates and click New > Certificate Template to Issue.
  5. Locate vSphere 6.0 or vSphere 6.0 VMCA under the Name column.
  6. Click OK.

See Also

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 22 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)




Please enter the Captcha code before clicking Submit.
  • 22 Ratings
Actions
KB: