Checking that the CA Root Cert is trusted on the vCenter Server

Be sure to check that the CA Root certificate is trusted on each vCenter Server that the VASA providers will be getting registered with.

While you can use either the vCenter UI or vCenter CLI to check the trusted root certs for the Root CA's cert, the CLI is going to offer more consistent results.

In the event that it's not there, you can use the vCenter CLI or vCenter UI to import the trusted root cert.

Here is an example of using the vCenter CLI to import a Root Cert to the Trusted Root Store:

## The root cert can either be SCP'd to the vCenter Server or you can just create a .pem file with the root cert ##

root@prod-vcsa [ ~ ]# vim /root/custom-root-cert.pem
root@prod-vcsa [ ~ ]# cat /root/custom-root-cert.pem
-----BEGIN CERTIFICATE-----
MIIDpDCCAoygAwIBAgIQfmGy6GutxYJCdMy6lXxqZjANBgkqhkiG9w0BAQsFADBE
MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFjAUBgoJkiaJk/IsZAEZFgZjc2d2ZGkx
EzARBgNVBAMTCkNBLUZBQ0xPVUQwHhcNMTkwNjE0MTk1MTI3WhcNMjkwNjE0MjAw
MTI3WjBEMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFjAUBgoJkiaJk/IsZAEZFgZj
c2d2ZGkxEzARBgNVBAMTCkNBLUZBQ0xPVUQwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQC518foxRwdfN39fX0zXy0ELkEjh//8iS5U8zgvYknA0Ip9aCYw
zB4Vgn/zXFAHvXb6AzljL6jcUFlLUNwWCBkiNBCNoAv5P6fNVhedsCF+q2RdNLkD
jW9w8Xs71nMf3HpasF2m7PNvtT/BRC8r9sVijV+8D5pcrMpM57FkIgUizTQB4HCi
KEzG/wrwU8YPOxB2EBgyhhjWa+HqdBao16hK5wtKMCgBZCfVMTr7lvT73qU/qcDZ
GdyvddslqS598dd6fO94R7A8TrlcVHe14PjOSmn2GgGHwwDvVyhoZmDjpNFV5CAI
yuo1ISCO5TebNpDnbXd2+Bge9gLn1X3DE+CVAgMBAAGjgZEwgY4wEwYJKwYBBAGC
NxQCBAYeBABDAEEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYD
VR0OBBYEFLUWvEe1Vs8+Zh9TWAVfYriidnTsMBIGCSsGAQQBgjcVAQQFAgMBAAEw
IwYJKwYBBAGCNxUCBBYEFH3NWbj+o48SD2H9JZcXRYegpf/bMA0GCSqGSIb3DQEB
CwUAA4IBAQCVooEUPOTGaXSFWiNc6ZMkp5oM6he80EsHCUPy4o7sS3uHzZ/DptnG
iwlnvzBwyNW0HqpZwjeLRYvNU5pkwRtxxtNeLoNUaUJ1kiEe6hEqOOIEca6htUuv
X0unZv5k8+Z1O1kBrvYFldkAG7VXZFZ08FIw/TKAW9aXeLa7+parv6zl03/XgstC
QcFfOwLT1Ebm+xPwgP3CCwcEUpH6GAM9jPSd23/iAy6mFFN3i0ToOi1GNtb0X7UM
HRkCpatFEMt+dLvd73dO/n7bUVSi7AhznlOaxmnimOU4KEVSIAgif8hGzDcip1tl
0ftrgaug1yLEKq+sJKSpCljIPd1dQOa3
-----END CERTIFICATE-----

root@prod-vcsa [ ~ ]#

## Then use the dir-cli tool to publish this root cert ##

root@prod-vcsa [ ~ ]# /usr/lib/vmware-vmafd/bin/dir-cli trustedcert publish --cert /root/custom-root-cert.pem
Enter password for administrator@sso.alex.purestorage.com:
Certificate pubished successfully
root@prod-vcsa [ ~ ]#

## The VMCA service should be started as well to ensure that the most consistant results are found ##

Process to Refresh ESXi Hosts CA/CRL via vCenter

If the Root CA cert is being imported for the first time, you will want to make sure that the vCenter Trusted Root certs are getting published to the ESXi hosts in the vCenter. This can be done manually for each host, however, PowerCLI and PowerShell can also do this.

Leverage the following workflow:

## Connect to the vCenter Server ##
Connect-VIServer -server vcenter-server
  
  
## Get the ESXi hosts and set it to a variable ##
$hosts = get-vmhost
  
  
## Start the Service Instance ##
$si = Get-View ServiceInstance
  
  
## Start the certificate Manager view ##
$certMgr = Get-View -Id $si.Content.CertificateManager
  
  
## Using the Cert Manager, refresh the ESXi hosts Certs ##
## This pushes all certificates in the TRUSTED_ROOTS store in the vCenter Server VECS store to the host. ##
$certMgr.CertMgrRefreshCACertificatesAndCRLs($Hosts.ExtensionData.MoRef)
  
  
## Now in vCenter the vvol datastore should be accessible for each of those hosts.  No need to do the ssl_reset and restart on VVold ##

Here is an example of this workflow:

PS C:\> Connect-VIServer -Server dev-vcsa

Name                           Port  User                          
----                           ----  ----                          
dev-vcsa                       443   ALEX\Carver                   

PS C:\> Get-Cluster -Name "Dev Cluster"

Name                           HAEnabled  HAFailover DrsEnabled DrsAutomationLevel  
                                          Level                                     
----                           ---------  ---------- ---------- ------------------  
Dev Cluster                    True       1          True       FullyAutomated      

PS C:\> $ESXi_Cluster = Get-Cluster -Name "Dev Cluster"

PS C:\> $ESXi_Cluster | Get-VMHost

Name                 ConnectionState PowerState NumCpu CpuUsageMhz CpuTotalMhz   MemoryUsageGB   MemoryTotalGB Version
----                 --------------- ---------- ------ ----------- -----------   -------------   ------------- -------
esxi-7.alex.pures... Connected       PoweredOn      16         151       38304          14.586         255.897   6.7.0
esxi-6.alex.pures... Connected       PoweredOn      20         141       43880          16.166         255.892   6.7.0
esxi-4.alex.pures... Connected       PoweredOn      20          94       43880           8.945         255.892   6.7.0

PS C:\> $hosts = $ESXi_Cluster | Get-VMHost

PS C:\> $hosts

Name                 ConnectionState PowerState NumCpu CpuUsageMhz CpuTotalMhz   MemoryUsageGB   MemoryTotalGB Version
----                 --------------- ---------- ------ ----------- -----------   -------------   ------------- -------
esxi-7.alex.pures... Connected       PoweredOn      16         151       38304          14.586         255.897   6.7.0
esxi-6.alex.pures... Connected       PoweredOn      20         141       43880          16.166         255.892   6.7.0
esxi-4.alex.pures... Connected       PoweredOn      20          94       43880           8.945         255.892   6.7.0

PS C:\> $si = Get-View ServiceInstance

PS C:\> $certMgr = Get-View -Id $si.Content.CertificateManager

PS C:\> $certMgr.CertMgrRefreshCACertificatesAndCRLs($Hosts.ExtensionData.MoRef)

PS C:\>
 

Once this is all completed, you can register the storage providers.