Wildcard SSL Cert with vCenter 6.0

K

KapsZ28

2[H]4U
Joined
May 29, 2009
Messages
2,114
Honestly I never bothered replacing the self-signed certs before, but with browsers stopping support of SHA-1 and trying to better follow the Security Hardening guide, I figured it would be a good time to start installing the proper SSL certificates.

Ideally I would like to just get a wildcard cert for internal servers since everything is on "na.domain.com". But I am not so sure that is possible with vCenter or I just don't know how to do it.

To start I am using VCSA 6.0 with an external Platform Services Controller. I was looking at this article, http://kb.vmware.com/selfservice/mi...nguage=en_US&cmd=displayKC&externalId=2112277 which goes over generating a CSR with the machine name which isn't what I am trying to accomplish. There is an option to Import custom certificates, but I want to ensure wildcard certs are supported before generating a CSR with OpenSSL and purchasing it.

I looked at a couple of other articles and noticed they mention having AD Certificate Services installed and started wondering if it is only supported using Microsoft Certificate Authority and not a third party like GeoTrust.

So the first question, are wildcard certs supported, and if so, how are they implemented? Or if they are not supported, is using a MS CA my only option or can I purchase valid certs?
 
I used that guide to import our wildcard cert to clear up the web ui ssl error. I skipped to step 7 and started there.
 
Do unrelated parties need to securely access your ESXi over the Internet? Otherwise, why buy a commercial cert for your own stuff? Makes no sense.
 
TCM2 said:
Do unrelated parties need to securely access your ESXi over the Internet? Otherwise, why buy a commercial cert for your own stuff? Makes no sense.
Click to expand...

In fact, some commercial certs will break certain VMware products (SRM).
 
lopoetve said:
In fact, some commercial certs will break certain VMware products (SRM).
Click to expand...

good to know :)

We use commercial certs to avoid running our own certificate authority but we are a small company and have been able to get away without one for a while. I'm sure at some point we will need to stand one up.
 
lopoetve said:
In fact, some commercial certs will break certain VMware products (SRM).
Click to expand...

Well that sucks. So what is recommended? Currently IE 9 and Edge both don't work. Just display a message "Content was blocked because it was not signed by a valid security certificate."

My main goal was standardization with all apps accessed using a web browser. A GeoTrust wildcard cert costs all of $200 a year.
 
RiDDLeRThC said:
good to know :)

We use commercial certs to avoid running our own certificate authority but we are a small company and have been able to get away without one for a while. I'm sure at some point we will need to stand one up.
Click to expand...

The problem I have with using a MS CA is the lack of standardization at my company. People using MacBooks, ChomeBooks, and some Windows. Absolutely nobody is part of the AD domain with the exception of me. I guess I could just force everyone to use RDS to access vCenter and other apps that require a web browser.
 
RiDDLeRThC said:
We use commercial certs to avoid running our own certificate authority
Click to expand...

You want to avoid commercial CAs unless absolutely necessary. If you need to prove authenticity only to yourself, why would you trust an additional third party (the CA) when you don't have to?

Using commercial certs because running your own CA is too hard or cumbersome is like saying "I don't trust myself, so I'll have some unrelated third party do it for me and open myself up to all its problems in the process".

It's completely backwards.
 
lopoetve said:
Run your own CA - but that's a pain too, don't get me wrong :)
Click to expand...

Already have one for running RADIUS. It is just all the non-domain computers people use, but I guess I will only support using vCenter from our RDS Farm.
 
Yeah, except if they don't know how or have an issue, then they will bother me. And I don't support Mac or Chromebooks. ;)
 
You must log in or register to reply here.
Back
Top