Hello everyone,
I'm trying to issue sub CA certificate for my Embedded vCSA installation. vCAS version 6.5.0.14100.
/var/tmp/vmware/certool.cfg
Country = RU
Name = vlab-PSC-CA
Organization = vlab
OrgUnit = IT
State = Moscow
Locality = Moscow
IPAddress = <my IP>
Email = <Some email>
Hostname = <My vCSA FQDN>
/var/tmp/vmware/MACHINE_SSL_CERT.cfg
Country = RU
Name = <My vCSA FQDN>
Organization = vlab
OrgUnit = IT
State = Moscow
Locality = Moscow
IPAddress = <my IP>
Email = <Some email>
Hostname = <My vCSA FQDN, My vCSA Hostname>
I'm running
root@<hostname> [ /usr/lib/vmware-vmca/bin ]# ./certificate-manager
Option[1 to 8]: 2
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : y
Please provide valid SSO and VC priviledged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ? : n
1. Generate Certificate Signing Request(s) and Key(s) for VMCA Root Signing certificate
2. Import custom certificate(s) and key(s) to replace existing VMCA Root Signing certificate
Option [1 or 2]: 1
Please provide a directory location to write the CSR(s) and PrivateKey(s) to:
Output directory path: /custom
2018-03-02T09:50:11.492Z Running command: ['/usr/lib/vmware-vmca/bin/certool', '--genkey', '--privkey', '/custom/vmca_issued_key.key', '--pubkey', '/tmp/pubkey.pub']
2018-03-02T09:50:11.679Z Done running command
2018-03-02T09:50:11.679Z Running command: ['/usr/lib/vmware-vmca/bin/certool', '--gencsrfromcert', '--privkey', '/custom/vmca_issued_key.key', '--cert', '/var/lib/vmware/vmca/root.cer', '--csrfile', '/custom/vmca_issued_csr.csr']
2018-03-02T09:50:11.700Z Done running command
CSR generated at: /custom/vmca_issued_csr.csr
1. Continue to importing Custom certificate(s) and key(s) for VMCA Root Signing certificate
2. Exit certificate-manager
Option [1 or 2]:
As you can see vCSA generates CSR based on existing root certificate (certool', '--gencsrfromcert', '--privkey'), but I've clearly stated that I want to generate based on files (Do you wish to generate all certificates using configuration file : Option[Y/N] ? : y). The result is incorrect CSR. Does anyone knows how to force certificate-manager to respect config file content?