{"id":3734,"date":"2020-05-04T17:31:00","date_gmt":"2020-05-04T15:31:00","guid":{"rendered":"https:\/\/vm.piszki.pl\/?p=3734"},"modified":"2021-05-04T17:34:01","modified_gmt":"2021-05-04T15:34:01","slug":"vsphere-6-7u3-unable-to-push-ca-certificates-and-crls-to-host","status":"publish","type":"post","link":"https:\/\/vm.piszki.pl\/?p=3734","title":{"rendered":"vSphere 6.7U3 &ndash; Unable to push CA certificates and CRLs to host"},"content":{"rendered":"<p align=\"justify\">Aktualna wersja vCenter 6.7U3 przynios\u0142a ze sob\u0105 ciekaw\u0105 zmian\u0119, jak mo\u017cemy przeczyta\u0107 <a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.7\/rn\/vsphere-vcenter-server-67u3-release-notes.html\">tu<\/a>, wszystkie certyfikaty CA trusted store musz\u0105 mie\u0107 ustawion\u0105 flag\u0119 X509v3 Basic Constraints: CA: TRUE. Brak tej flagi w jakimkolwiek certyfikacie blokuje w zasadzie wszelkie operacje na certyfikatach, pojawia si\u0119 b\u0142\u0105d \u201cCertificate is not valid CA certificate\u201d. Dzi\u015b na przyk\u0142adzie problemu z od\u015bwie\u017ceniem certyfikat\u00f3w CA na poziomie hosta, poka\u017c\u0119 jak sobie z tym poradzi\u0107. Generalnie, tak jak pisa\u0142em w tym <a href=\"https:\/\/vm.piszki.pl\/blad-dodania-do-vmware-ceip-server-chain-certificate-is-not-trusted-przy-zewnetrznym-psc\/\">po\u015bcie<\/a>, w magazynie certyfikat\u00f3w CA vCenter powinien panowa\u0107 porz\u0105dek, ba\u0142agan niesie ze sob\u0105 same problemy.<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca3.png\"><img loading=\"lazy\" decoding=\"async\" width=\"863\" height=\"144\" title=\"ca3\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca3\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca3_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p><!--more--><\/p>\n<p align=\"justify\">W ramach przygotowa\u0144 do od\u015bwie\u017cenia certyfikatu vCenter (machine cert), postanowi\u0142em dogra\u0107 do trusted store nowe certyfikaty CA oraz przes\u0142a\u0107 je do wszystkich host\u00f3w ESXi. Procedura zatrzyma\u0142a si\u0119 bardzo szybko z komunikatem:<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca0.png\"><img loading=\"lazy\" decoding=\"async\" width=\"388\" height=\"223\" title=\"ca0\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca0\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca0_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p align=\"justify\">Zaraz za komunikatem \u201cCertificate is not valid CA certificate\u201d jest wylistowany certyfikat, i nie by\u0142 to \u017caden z certyfikat\u00f3w CA kt\u00f3re doda\u0142em. Jak si\u0119 okaza\u0142o, po sprawdzeniu zawarto\u015bci trusted store, znajdowa\u0142 si\u0119 tam certyfikat vCenter (w dodatku dawno nie aktualny).<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca1.png\"><img loading=\"lazy\" decoding=\"async\" width=\"402\" height=\"196\" title=\"ca1\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca1\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca1_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca2.png\"><img loading=\"lazy\" decoding=\"async\" width=\"402\" height=\"248\" title=\"ca2\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca2\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca2_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p align=\"justify\">Do pewnego momentu stosowali\u015bmy certyfikaty podpisane przez zewn\u0119trzne CA dla vCenter, p\u00f3\u017aniej przeszli\u015bmy na certyfikaty generowane przez VMCA podpisane przez MSCA. Ten certyfikat to pozosta\u0142o\u015b\u0107 po migracji i zdecydowanie jego obecno\u015b\u0107 jest niezgodna z polityk\u0105 6.7U3. Aby rozwi\u0105za\u0107 problem certyfikat vCenter nale\u017cy usun\u0105\u0107 z trusted store, robimy to z poziomu pow\u0142oki systemu vCenter. Listujemy zawarto\u015b\u0107 trusted store:<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"696\" height=\"206\" title=\"ca4\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca4\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca4_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p align=\"justify\">Listujemy certyfikaty aby sprawdzi\u0107 w\u0142a\u015bciwy ID certyfikatu, nast\u0119pnie eksportujemy interesuj\u0105cy nas certyfikat i na ko\u0144cu usuwamy go z VMDIR:<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca5.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"697\" height=\"430\" title=\"ca5\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca5\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca5_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p align=\"justify\">Na ko\u0144cu usuwamy ten certyfikat z VECS:<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca6.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"698\" height=\"70\" title=\"ca6\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca6\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca6_thumb.jpg\" border=\"0\"><\/a><\/p>\n<p align=\"justify\">Wszystkie kroki wykonujemy zgodnie z tym <a href=\"https:\/\/kb.vmware.com\/s\/article\/2146011\">KB<\/a>, jako \u017ce skasowali\u015bmy certyfikat kt\u00f3ry nie by\u0142 wykorzystywany, nie musimy wykonywa\u0107 jakiegokolwiek restartu. Mo\u017cemy od razu od\u015bwie\u017cy\u0107 certyfikaty CA na ESXi:<\/p>\n<p><a href=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca7.png\"><img loading=\"lazy\" decoding=\"async\" width=\"380\" height=\"76\" title=\"ca7\" style=\"border: 0px currentcolor; border-image: none; margin-right: auto; margin-left: auto; float: none; display: block; background-image: none;\" alt=\"ca7\" src=\"https:\/\/vm.piszki.pl\/wp-content\/uploads\/2019\/11\/ca7_thumb.jpg\" border=\"0\"><\/a><\/p>\n<div style='text-align:left' class='yasr-auto-insert-visitor'><\/div>","protected":false},"excerpt":{"rendered":"<p>Aktualna wersja vCenter 6.7U3 przynios\u0142a ze sob\u0105 ciekaw\u0105 zmian\u0119, jak mo\u017cemy przeczyta\u0107 tu, wszystkie certyfikaty CA trusted store musz\u0105 mie\u0107 ustawion\u0105 flag\u0119 X509v3 Basic Constraints: CA: TRUE. Brak tej flagi w jakimkolwiek certyfikacie blokuje w zasadzie wszelkie operacje na certyfikatach, &hellip; <a href=\"https:\/\/vm.piszki.pl\/?p=3734\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"yasr_overall_rating":0,"yasr_post_is_review":"","yasr_auto_insert_disabled":"","yasr_review_type":"","footnotes":""},"categories":[36,45],"tags":[44,146,144,145],"class_list":["post-3734","post","type-post","status-publish","format-standard","hentry","category-analiza","category-poradniki","tag-ca","tag-vecs","tag-vmca","tag-vmdir"],"yasr_visitor_votes":{"stars_attributes":{"read_only":false,"span_bottom":false},"number_of_votes":0,"sum_votes":0},"_links":{"self":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts\/3734"}],"collection":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3734"}],"version-history":[{"count":2,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts\/3734\/revisions"}],"predecessor-version":[{"id":3823,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts\/3734\/revisions\/3823"}],"wp:attachment":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}