vD vDan VMware · VCF · NSX · K8S

VCF Certificate Tool Navigator

Short answer: the VCF 9.1 Certificate Tool (vcf-cert-tool) is the break-glass utility that repairs expired or broken internal certificates by driving the native recovery scripts of each component: vCert for vCenter and ESXi, CARR for NSX, the CASA actions of VCF Operations, certmgr for the vSphere Supervisor and the Cloud Proxy scripts. In short, this navigator turns the 44-page user guide into something you can use under pressure. First, pick the symptom and get the runbook with the exact keystroke path through the menus, the snapshots and checks to do first, what the tool restarts and where its logs are. In addition, you can browse all 97 menu entries of the five modules and generate the launch-host commands. Finally, the version, KB, log and certificate-file tables stay at hand.

Prefer a full window? Open the navigator full screen →

What the VCF Certificate Tool can and cannot do

  • Five modules, one menu. vSphere (vCert, 9 top-level operations with 14 certificate stores to manage), NSX (CARR dry run, recovery, log collection and a configurable validation profile), VCF Operations (check, take the cluster offline, regenerate internal certificates on one node or a whole cluster, list, switch to internal or import a web certificate), vSphere Supervisor (certmgr list, check, backup, rotate all or only the Spherelet certificates) and Cloud Proxy (check, restore the north-facing connection to the Ops cluster, restore the inbound certificate, list).
  • Break-glass, not lifecycle. It is meant to be run at the direction of Broadcom Global Support. It replaces self-signed and VMCA-issued certificates (NSX: self-signed only) and restarts services. However, it does not refresh the trust that SDDC Manager, VCF Operations, NSX or Automation keep for the component you repaired. Therefore, Unified Certificate Management stays the day-to-day path.
  • Launch host. First, transfer the .tgz in binary mode to a VCF Operations node (recommended) or a vCenter appliance. Then extract it, run ./start.py, acknowledge the banner and pick the component. Afterwards, framework logs land in /tmp/session-root/session-current/; each native tool logs on its own target.

Sources