Preparing a Microsoft CA SSL Certificate Template for vSphere 5.x

Creating an SSL certificate for either VMware vCenter or ESXi requires some specific properties from the Template that will be used to generate them (as shown here).

As stated in the KB:
Starting from Windows Server 2008 and later some properties are no longer present on the Web Server template by default such as:

• Data Encipherment
• Nonrepudiation
• Client Authentication

While vSphere 5.0 requires the use of Nonrepudiation and Client Authentication on the Generated Certificate vSphere 5.1 and 5.5 only require Data Encipherment on them.

Note that it won't hurt to have properties like Nonrepudiation or Client Authentication on 5.1 or 5.5 environments.

Keep in mind that if you plan on using a custom SSL Certificate for VMware Site Recovery Manager (SRM) then you need those properties on the template:

• Client Authentication
• Allow private key to be exported

So let's get started!

First of all let's go in our Certification Authority to find our Certificate Templates And select Manage from the contextual menu (or you may use the shortcut certtmpl.msc to go straight to the template console)

Now let's duplicate our Web Server template by using the contextual menu action Duplicate Template

Make sure to select Windows Server 2003 Enterprise as a Minimal Supported CA

Alright, the template just has to be tuned by now!

In the main windows we're going to name our template VMware SSL (note the difference between the display name and the template name, the display name has an escape character while the template name doesn't).

The template name shall be used by tools like certreq, so all upcoming requests shall be adressed to VMwareSSL.

In the Extensions tab we'll start by adding the Client Authentication to the Application Policies (Client Authentication is only needed for vSphere 5.0 but it won't hurt to add it).

Note that VMware Site Recovery Manager (SRM) need the Client Authentication property.

Next we're going to Edit the Key Usage and tick Allow encryption of user data and optionally if you're still on vSphere 5.0 (or below) Signature is proof of origin (nonrepudiation)

If you plan on having and replacing the SSL Certificates for VMware Site Recovery Manager (SRM) in your Infrastructure then make sure that Allow private key to be exported is selected (You can also create another template for it).

Let's make sure that Supply in the request is selected in the Subject Name and we're done

The template is now created. All that's left to do is Issue it to the available Certificate Template of the CA.

Let's Issue the template by using New >> Certificate Template to Issue  from the contextual menu over the Certificate Templates folder

Here we simply select our VMware SSL template and we click on Ok.

Our template is now ready to be used!

Replacing VMware ESXi SSL Certificate

Replacing the default ESXi Certificate is a good security practice. Most vSphere components rely on SSL Certificate for encrypted communication.

The SSL Certificate on an ESXi need to be in an x509 v3 format (See "Replacing Default vCenter 5.1 and ESXi Certificates" here for more information)

I will be using OpenSSL to create the Certificate request before signing it via my Microsoft AD CS.

Let's get started! Here's the OpenSSL template that I'll use for my ESXi (5.1):

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:esxi02, DNS:esxi02.katalykt.lan
 
[ req_distinguished_name ]
countryName = FR
stateOrProvinceName = Normandie
localityName = Caen
0.organizationName = Katalykt
organizationalUnitName = ESXi
commonName = esxi02.katalykt.lan

Note that the Common Name (commonName) shall match the FQDN of the ESXi.

So here's my esxi.cfg which contains the above OpenSSL template

Let's start by generating our Private Key rui.key using an RSA 2048 encryption. (Make sure that the Command Prompt is launched by using the "Run as Administrator" feature on Windows)

c:\OpenSSL-Win32\bin\openssl.exe genrsa 2048 > rui.key

Now let's create a Certificate Signing Request (CSR) rui.csr using our Private Key rui.key and our template esxi.cfg

c:\OpenSSL-Win32\bin\openssl.exe req -out rui.csr -key rui.key -new -config esxi.cfg

Once that our CSR file is ready, we're about to submit it to the Microsoft CA. In this case I'll be using the certreq tool (you can also use the web interface to submit it if available)

Note that I'm using a Template called VMwareSSL (See my article about Microsoft CA Template for vSphere 5.x here for more information about the template's properties)

Note that "DC1\katalykt-DC1-CA" refers to my Microsoft CA's name and that the template name specified matches the "Template Name" of the certificate (not the display name!)

certreq -submit -config "DC1\katalykt-DC1-CA" -attrib "CertificateTemplate:VMwareSSL" rui.csr rui.crt

Alright, if everything goes smooth we should have a rui.crt in our folder. Let's convert it to an x509 format so that our ESXi may understand it.

c:\OpenSSL-Win32\bin\openssl.exe x509 -in rui.crt -out rui.crt

And tadaaa! we just have to place the rui.crt and the rui.key (Certificate & Private Key) on our ESXi. This operation can be done with different tools and may be automated with vSphere CLI or even Power CLI.

After activating SSH on my ESXi I've decide to use WinSCP to copy my certificates over there.

We want to go at /etc/vmware/ssl in order to replace both the existing Private key and it's SSL Certificate

I'll be moving the current SSL Certificate in a folder called ssl_default (The certificate and it's key can be moved safely).

So let's copy the new SSL certificate and it's key on the ESXi.

After a restart of the management agents, our ESXi will proudly display it's brand new SSL Certificate as valid!

Make sure that the CA Root Certificate which signed our ESXi (in our case our "katalykt-DC1-CA") is installed within the "Trusted Root Certification Authorities" of the vCenter server.

If it hasn't be done already, the steps to import are pretty much straightforward:

• Run mmc.exe on the vCenter Server
• Select Add/Remove Snap-in...
• Select Certificates
• Tick Computer Account
• Select Local Computer
• Import the Root CA within on the Certificates folder present within Trusted Root Certification Authorities