Впринципе сразу понял что чтото с сертификатами. Точно просроченые и забыл перегенерить.
Подключаемя по ssh (надеюсь пароль root помню)
Проверяем что там проспрочилось:Запускаем еще раз и смотрим что с сертификатами:#!/bin/bash # Copyright (c) 2020-2021 VMware, Inc. All rights reserved. # VMware Confidential # # Run this from the affected PSC/VC # # NOTE: This works on external and embedded PSCs # This script will do the following # 1: Regenerate STS certificate # # What is needed? # 1: Offline snapshots of VCs/PSCs # 2: SSO Admin Password NODETYPE=$(cat /etc/vmware/deployment.node.type) if [ "$NODETYPE" = "management" ]; then echo "Detected this node is a vCenter server with external PSC." echo "Please run this script from a vCenter with embedded PSC, or an external PSC" exit 1 fi if [ "$NODETYPE" = "embedded" ] && [ ! -f /usr/lib/vmware-vmdir/sbin/vmdird ]; then echo "Detected this node is a vCenter gateway" echo "Please run this script from a vCenter with embedded PSC, or an external PSC" exit 1 fi echo "NOTE: This works on external and embedded PSCs" echo "This script will do the following" echo "1: Regenerate STS certificate" echo "What is needed?" echo "1: Offline snapshots of VCs/PSCs" echo "2: SSO Admin Password" echo "IMPORTANT: This script should only be run on a single PSC per SSO domain" mkdir -p /tmp/vmware-fixsts SCRIPTPATH="/tmp/vmware-fixsts" LOGFILE="$SCRIPTPATH/fix_sts_cert.log" echo "==================================" | tee -a $LOGFILE echo "Resetting STS certificate for $HOSTNAME started on $(date)" | tee -a $LOGFILE echo ""| tee -a $LOGFILE echo "" DN=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmdir]' | grep dcAccountDN | awk '{$1=$2=$3="";print $0}'|tr -d '"'|sed -e 's/^[ \t]*//') echo "Detected DN: $DN" | tee -a $LOGFILE PNID=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep PNID | awk '{print $4}'|tr -d '"') echo "Detected PNID: $PNID" | tee -a $LOGFILE PSC=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep DCName | awk '{print $4}'|tr -d '"') echo "Detected PSC: $PSC" | tee -a $LOGFILE DOMAIN=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep DomainName | awk '{print $4}'|tr -d '"') echo "Detected SSO domain name: $DOMAIN" | tee -a $LOGFILE SITE=$(/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmafd\Parameters]' | grep SiteName | awk '{print $4}'|tr -d '"') MACHINEID=$(/usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost) echo "Detected Machine ID: $MACHINEID" | tee -a $LOGFILE IPADDRESS=$(ifconfig | grep eth0 -A1 | grep "inet addr" | awk -F ':' '{print $2}' | awk -F ' ' '{print $1}') echo "Detected IP Address: $IPADDRESS" | tee -a $LOGFILE DOMAINCN="dc=$(echo "$DOMAIN" | sed 's/\./,dc=/g')" echo "Domain CN: $DOMAINCN" ADMIN="cn=administrator,cn=users,$DOMAINCN" USERNAME="administrator@${DOMAIN^^}" ROOTCERTDATE=$(openssl x509 -in /var/lib/vmware/vmca/root.cer -text | grep "Not After" | awk -F ' ' '{print $7,$4,$5}') TODAYSDATE=$(date +"%Y %b %d") echo "#" > $SCRIPTPATH/certool.cfg echo "# Template file for a CSR request" >> $SCRIPTPATH/certool.cfg echo "#" >> certool.cfg echo "# Country is needed and has to be 2 characters" >> $SCRIPTPATH/certool.cfg echo "Country = DS" >> $SCRIPTPATH/certool.cfg echo "Name = $PNID" >> $SCRIPTPATH/certool.cfg echo "Organization = VMware" >> $SCRIPTPATH/certool.cfg echo "OrgUnit = VMware" >> $SCRIPTPATH/certool.cfg echo "State = VMware" >> $SCRIPTPATH/certool.cfg echo "Locality = VMware" >> $SCRIPTPATH/certool.cfg echo "IPAddress = $IPADDRESS" >> $SCRIPTPATH/certool.cfg echo "Email = email@acme.com" >> $SCRIPTPATH/certool.cfg echo "Hostname = $PNID" >> $SCRIPTPATH/certool.cfg echo "==================================" | tee -a $LOGFILE echo "==================================" | tee -a $LOGFILE echo "" echo "Detected Root's certificate expiration date: $ROOTCERTDATE" | tee -a $LOGFILE echo "Detected today's date: $TODAYSDATE" | tee -a $LOGFILE echo "==================================" | tee -a $LOGFILE flag=0 if [[ $TODAYSDATE > $ROOTCERTDATE ]]; then echo "IMPORTANT: Root certificate is expired, so it will be replaced" | tee -a $LOGFILE flag=1 mkdir /certs && cd /certs cp $SCRIPTPATH/certool.cfg /certs/vmca.cfg /usr/lib/vmware-vmca/bin/certool --genselfcacert --outprivkey /certs/vmcacert.key --outcert /certs/vmcacert.crt --config /certs/vmca.cfg /usr/lib/vmware-vmca/bin/certool --rootca --cert /certs/vmcacert.crt --privkey /certs/vmcacert.key fi echo "#" > $SCRIPTPATH/certool.cfg echo "# Template file for a CSR request" >> $SCRIPTPATH/certool.cfg echo "#" >> $SCRIPTPATH/certool.cfg echo "# Country is needed and has to be 2 characters" >> $SCRIPTPATH/certool.cfg echo "Country = DS" >> $SCRIPTPATH/certool.cfg echo "Name = STS" >> $SCRIPTPATH/certool.cfg echo "Organization = VMware" >> $SCRIPTPATH/certool.cfg echo "OrgUnit = VMware" >> $SCRIPTPATH/certool.cfg echo "State = VMware" >> $SCRIPTPATH/certool.cfg echo "Locality = VMware" >> $SCRIPTPATH/certool.cfg echo "IPAddress = $IPADDRESS" >> $SCRIPTPATH/certool.cfg echo "Email = email@acme.com" >> $SCRIPTPATH/certool.cfg echo "Hostname = $PNID" >> $SCRIPTPATH/certool.cfg echo "" echo "Exporting and generating STS certificate" | tee -a $LOGFILE echo "" cd $SCRIPTPATH /usr/lib/vmware-vmca/bin/certool --server localhost --genkey --privkey=sts.key --pubkey=sts.pub /usr/lib/vmware-vmca/bin/certool --gencert --cert=sts.cer --privkey=sts.key --config=$SCRIPTPATH/certool.cfg openssl x509 -outform der -in sts.cer -out sts.der CERTS=$(csplit -f root /var/lib/vmware/vmca/root.cer '/-----BEGIN CERTIFICATE-----/' '{*}' | wc -l) openssl pkcs8 -topk8 -inform pem -outform der -in sts.key -out sts.key.der -nocrypt i=1 until [ $i -eq $CERTS ] do openssl x509 -outform der -in root0$i -out vmca0$i.der ((i++)) done echo "" echo "" read -s -p "Enter password for administrator@$DOMAIN: " DOMAINPASSWORD echo "" # Find the highest tenant credentials index MAXCREDINDEX=1 while read -r line do INDEX=$(echo "$line" | tr -dc '0-9') if [ $INDEX -gt $MAXCREDINDEX ] then MAXCREDINDEX=$INDEX fi done < <(/opt/likewise/bin/ldapsearch -h localhost -p 389 -b "cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "(objectclass=vmwSTSTenantCredential)" cn | grep cn:) # Sequentially search for tenant credentials up to max index and delete if found echo "Highest tenant credentials index : $MAXCREDINDEX" | tee -a $LOGFILE i=1 if [ ! -z $MAXCREDINDEX ] then until [ $i -gt $MAXCREDINDEX ] do echo "Exporting tenant $i to $SCRIPTPATH" | tee -a $LOGFILE echo "" ldapsearch -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" -b "cn=TenantCredential-$i,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" > $SCRIPTPATH/tenantcredential-$i.ldif if [ $? -eq 0 ] then echo "Deleting tenant $i" | tee -a $LOGFILE ldapdelete -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "cn=TenantCredential-$i,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" | tee -a $LOGFILE else echo "Tenant $i not found" | tee -a $LOGFILE echo "" fi ((i++)) done fi echo "" # Find the highest trusted cert chains index MAXCERTCHAINSINDEX=1 while read -r line do INDEX=$(echo "$line" | tr -dc '0-9') if [ $INDEX -gt $MAXCERTCHAINSINDEX ] then MAXCERTCHAINSINDEX=$INDEX fi done < <(/opt/likewise/bin/ldapsearch -h localhost -p 389 -b "cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "(objectclass=vmwSTSTenantTrustedCertificateChain)" cn | grep cn:) # Sequentially search for trusted cert chains up to max index and delete if found echo "Highest trusted cert chains index: $MAXCERTCHAINSINDEX" | tee -a $LOGFILE i=1 if [ ! -z $MAXCERTCHAINSINDEX ] then until [ $i -gt $MAXCERTCHAINSINDEX ] do echo "Exporting trustedcertchain $i to $SCRIPTPATH" | tee -a $LOGFILE echo "" ldapsearch -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" -b "cn=TrustedCertChain-$i,cn=TrustedCertificateChains,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" > $SCRIPTPATH/trustedcertchain-$i.ldif if [ $? -eq 0 ] then echo "Deleting trustedcertchain $i" | tee -a $LOGFILE ldapdelete -h localhost -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" "cn=TrustedCertChain-$i,cn=TrustedCertificateChains,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" | tee -a $LOGFILE else echo "Trusted cert chain $i not found" | tee -a $LOGFILE fi echo "" ((i++)) done fi echo "" i=1 echo "dn: cn=TenantCredential-1,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" > sso-sts.ldif echo "changetype: add" >> sso-sts.ldif echo "objectClass: vmwSTSTenantCredential" >> sso-sts.ldif echo "objectClass: top" >> sso-sts.ldif echo "cn: TenantCredential-1" >> sso-sts.ldif echo "userCertificate:< file:sts.der" >> sso-sts.ldif until [ $i -eq $CERTS ] do echo "userCertificate:< file:vmca0$i.der" >> sso-sts.ldif ((i++)) done echo "vmwSTSPrivateKey:< file:sts.key.der" >> sso-sts.ldif echo "" >> sso-sts.ldif echo "dn: cn=TrustedCertChain-1,cn=TrustedCertificateChains,cn=$DOMAIN,cn=Tenants,cn=IdentityManager,cn=Services,$DOMAINCN" >> sso-sts.ldif echo "changetype: add" >> sso-sts.ldif echo "objectClass: vmwSTSTenantTrustedCertificateChain" >> sso-sts.ldif echo "objectClass: top" >> sso-sts.ldif echo "cn: TrustedCertChain-1" >> sso-sts.ldif echo "userCertificate:< file:sts.der" >> sso-sts.ldif i=1 until [ $i -eq $CERTS ] do echo "userCertificate:< file:vmca0$i.der" >> sso-sts.ldif ((i++)) done echo "" echo "Applying newly generated STS certificate to SSO domain" | tee -a $LOGFILE /opt/likewise/bin/ldapmodify -x -h localhost -p 389 -D "cn=administrator,cn=users,$DOMAINCN" -w "$DOMAINPASSWORD" -f sso-sts.ldif | tee -a $LOGFILE echo "" echo "Replacement finished - Please restart services on all vCenters and PSCs in your SSO domain" | tee -a $LOGFILE echo "==================================" | tee -a $LOGFILE echo "IMPORTANT: In case you're using HLM (Hybrid Linked Mode) without a gateway, you would need to re-sync the certs from Cloud to On-Prem after following this procedure" | tee -a $LOGFILE echo "==================================" | tee -a $LOGFILE echo "==================================" | tee -a $LOGFILE if [ $flag == 1 ] then echo "Since your Root certificate was expired and was replaced, you will need to replace your MachineSSL and Solution User certificates" | tee -a $LOGFILE echo "You can do so following this KB: https://kb.vmware.com/s/article/2097936" | tee -a $LOGFILE fi
STORE MACHINE_SSL_CERT
Alias : __MACHINE_CERT
Not After : Mar 2 16:02:39 2024 GMT
STORE TRUSTED_ROOTS
Alias : 991e8581f9a533189c342cc15b3547a0cebd6f16
Not After : May 10 16:03:27 2029 GMT
Alias : 69431a714a761f96c0075500c1e4c77ae94e639e
Not After : Feb 24 00:15:59 2032 GMT
Alias : b990662a60955dd060226785e710098a87239d06
Not After : Feb 26 13:59:06 2032 GMT
Alias : 1988ceca10ff02aeebb731f57ca10152dab0f2b8
Not After : Feb 26 16:03:25 2032 GMT
Alias : 08f1499dfd3035f67f95306c1164ea28e59c749f
Not After : Feb 26 16:12:39 2032 GMT
Alias : 3d9f4f0cf8633809e96d03b29d52475c63a8d643
Not After : Mar 9 21:28:42 2032 GMT
STORE TRUSTED_ROOT_CRLS
Alias : c5e18cb86220e127cc4577195aecd8d849fe247b
Alias : b966a5ae860661da51d7e19d0aaf676c8f71ab2d
Alias : 9f104ab8c72b024752f5f386dacd279f6f47203f
Alias : 15ec33679a495a86e7d84003d1dbf072f75e65e7
Alias : ce9722cb3ccd45243b04fec5fc7b1c24c9e84259
Alias : 098d9e93c44b3c8bd8a0d560b0f49bd53b72fe6e
STORE machine
Alias : machine
Not After : Mar 2 15:54:02 2024 GMT
STORE vsphere-webclient
Alias : vsphere-webclient
Not After : Mar 2 15:54:03 2024 GMT
STORE vpxd
Alias : vpxd
Not After : Mar 2 15:54:03 2024 GMT
STORE vpxd-extension
Alias : vpxd-extension
Not After : Mar 2 15:54:04 2024 GMT
STORE APPLMGMT_PASSWORD
Alias : location_password_default
STORE data-encipherment
Alias : data-encipherment
Not After : May 10 16:03:27 2029 GMT
STORE SMS
Alias : sms_self_signed
Not After : May 16 16:07:50 2029 GMT
STORE BACKUP_STORE
Alias : bkp___MACHINE_CERT
Not After : Mservice-control --status
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.7 Certificate Manager *** |
| |
| -- Select Operation -- |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : y
Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:administrator@vsphere.myhome
Enter password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ? : n
Continue operation : Option[Y/N] ? : y
Комментариев нет :
Отправить комментарий