Wednesday, June 1, 2011

Generating new certificates for the ESX host

The ESX host generates certificates the first time the system is started. Under certain circumstances, it might be required to force the host to generate new certificates. Typically new certificates only need to be generated if the hostname has been changed or the certificates have been deleted accidentally.

Each time you restart the vmware-hostd process, the mgmt-vmware script searches for existing certificate files (rui.crt and rui.key). If the files cannot be found, new certificate files are generated.
1.In the directory /etc/vmware/ssl, back up any existing certificates by renaming them with these commands:
1.mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/orig.rui.crt
2.mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/orig.rui.key
2.Restart the vmware-hostd process with the command: "service mgmt-vmware restart". This will generate new certificates based on the new IP address.
3.Confirm that the ESX host successfully generated new certificates by running this command and comparing the time stamps of the new certificate files with orig.rui.crt and orig.rui.key: "ls -la /etc/vmware/ssl/rui*"
You should be good. Do a hard reset of the server, and the new hostname and IP address should be in place.

No comments: