Free SSL cert from Let's Encrypt or Buypass on VMware VCSA

Jan 1, 2019 · Comments
VMware

Warning

For me this is a setup in a non-production home lab environment, and not something I’d recommend doing in a production environment. There is no added security by the certificate in doing this, as the VCSA should already be in a internal management trusted sone.

Pre-requisites

Preinstalled VMware vCenter Server Appliance (VCSA).
A bastion host for running certbot which has ssh access to VCSA.

Setting up the VCSA to trust Let’s Encrypt or Buypass root certificate

I’m adding the root CA manually as this will be a one time process, and will not need to be done later on. For this you will need to login to your VCSA.

post8-1

Open the vSpehre Client (HTML5).

post8-2

post8-3

When you’re logged in, go to “Menu” -> “Administration”.

post8-4

Then go to “Certificates” -> “Certificate Mangement”.

post8-5

Then you need to login again with the FQDN for the server, and administrative user, and password.

post8-6

When you’ve logged in, you’ll find the section called “Trusted Root Certificates”. You’ll need to press “Add” here.

post8-7

You’ll then have to browse to the correct root CA to add.

Let’s Encrypt root CA

The Let’s Encrypt most used root CA is called “TrustID X3” and is from IdenTrust and can be downloaded here.

Or if you trust this site the content of the root CA file is below.

Buypass GO root CA

Buypass uses it’s own root CA and can be downloaded here.

Or if you trust this site the content of the root CA file is below.

post8-8

When you’ve chosen the correct file, then click ‘Add’. You’ve now successfully added a new root CA as trusted to your VCSA.

Setting up certbot

First you’ll need to install certbot on your bastion host if you do not have it installed already.

yum install certbot

Now, since I also use Cloudflare, I use the DNS plugin for that for validation.

yum install python2-certbot-dns-cloudflare

Tweaking SSH access to VCSA

Now we’ll also need to do some changes to VCSA to allow SSH access, and you also need a public key for passowrdless authentication. On your bastion either copy your public key, or create one if you have none.

ssh-keygen -t rsa

Just press enter on the passphrase so it will be empty. Then copy the content from “~/.ssh/id_rsa.pub”. Then login to the VCSA by running SSH from your bastion host.

ssh root@vcenter.local.techie.cloud

When you login the first time, you’ll get into the VCSA cli, here you need to type the command “shell” to get to a normal shell.

shell

Now swith the root users shell to “bash”. This is also mentioned in KB#2100508.

chsh -s /bin/bash root

Then you’ll need to paste the content of your id_rsa.pub into “~/.ssh/authorized_keys”. And afterwards you can exit. Now test the passwordless login from your bastion host to see that it is working as expected.

Running certbot

Now we need to set up the connection between certbot and vcenter for the automation. I’ve set up this script as “/etc/letsencrypt/renewal-hooks/post/renew-vcenter.sh”, which will run as an deploy hook in certbot.

#!/usr/bin/bash
VCENTER_HOST="vcenter.local.techie.cloud"
VCENTER_ADMIN_USER="root"
VCENTER_CERT_LOCATION="/tmp"
CERTLOCATION="${RENEWED_LINEAGE}"
CERTNAME="${RENEWED_DOMAINS}"

scp "${CERTLOCATION}/fullchain.pem" "${CERTLOCATION}/privkey.pem" ${VCENTER_ADMIN_USER}@${VCENTER_HOST}:${VCENTER_CERT_LOCATION}
ssh ${VCENTER_ADMIN_USER}@${VCENTER_HOST} "service-control --stop --all;service-control --start vmafdd vmdird vmcad;/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CERT -y;/usr/lib/vmware-vmafd/bin/vecs-cli entry create --store MACHINE_SSL_CERT --alias __MACHINE_CERT --cert /tmp/fullchain.pem --key /tmp/privkey.pem;service-control --stop --all;service-control --start --all"

Remeber to make the script executable.

chmod 755 /etc/letsencrypt/renewal-hooks/post/renew-vcenter.sh

Now it’s time to run the certbot command for issuing the certificate.

Let’s Encrypt command

certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini  -d vcenter.local.techie.cloud --email example@techie.cloud --deploy-hook /etc/letsencrypt/renewal-hooks/post/renew-vcenter.sh

Buypass GO command

certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini --server https://api.buypass.com/acme/directory --email example@techie.cloud -d vcenter.local.techie.cloud --deploy-hook /etc/letsencrypt/renewal-hooks/post/renew-vcenter.sh

And then you set up the normal cron job for renewing certbot and everything should now be fine and you’ll have an trusted official certificate on the VCSA web GUI.

Ketil Gjerde