vCD-SP 8: Replace certificates

I currently have some self signed certificates on my vCloud Director 8 installation and want to update them with new certificates.  Here are the simplified steps to get this accomplished:

Firstly you need to create 2 certificates for each member of the group (cell) and import the certificates into host keystores.  Each vCD has 2 IP address which allows support for 2 different SSL endpoints(http and consoleproxy).  Each endpoint requires its own SSL certificate.

Requirements for cert include an X.500 distinguished name, while Subject Alternative Name is not necessary.

Replace certificate using vCD configuration script:  (this does not work in 8.10 anymore)
this process will also validate the db connection and prompt for SSL certificate and skips all other.

Before doing any work, take a snapshot of your VCD Cells and backup your database.

1. SSH to vCD cell
2. Stop the vCD services
1. service vmware-vcd stop
3. Run the configuration
1. /opt/vmware/vcloud-director/bin/configure
2. Specify full path to java keystore that holds the new certificates
3. Provide keystore and certificate password

This will replace the certificates and restart the vCD services.

Replace certificates using the certificates command:

Certificates command of the cell management tool automates process replace certificates in JCEKS keystore.

1. # cd /opt/vmware/vcloud-director/bin
2. # ./cell-management-tool certificates -j -k /tmp/<certificate-file-name>.ks -w keystorepassword
3. Restart the cell for changes to take affect.
1. # service vmware-vcd restart