Replacing the VMware Identity Manager (vIDM) Certificate with Aria Suite Lifecycle 8.x

Replace the vIDM (Workspace ONE Access) certificate with Aria Suite Lifecycle 8.18: CSR, Locker import, re-trust, load balancer, expired certs, VCF 9 status.

Short answer: Replace the VMware Identity Manager (vIDM, Workspace ONE Access) certificate from Aria Suite Lifecycle 8.x, not on the appliance. Generate a CSR in Locker, import the signed certificate with its chain and private key, snapshot the globalenvironment, then run Replace Certificate on the VMware Identity Manager product and re-trust every dependent product. For a cluster, update the load balancer certificate first. If the certificate has already expired, use the node :8443/cfg/ssl page instead.

What vIDM is and where it stands in VCF 9

vIDM (later renamed Workspace ONE Access, version 3.3.x) is the identity provider that Aria Suite Lifecycle deploys into the globalenvironment and that Aria Automation, Aria Operations and other Aria 8.x products use for SSO. Its SSL certificate secures the web UI and is trusted by every integrated product. That is why a certificate change has to be followed by a re-trust.

In VCF 9 the picture changes. According to Broadcom KB 390634, VMware Identity Manager 3.3.x has no in-place upgrade to VCF 9.0. It keeps being managed by Aria Suite Lifecycle 8.x, and all its Day-N operations (including certificate replacement) must be performed there. The new component in VCF 9.0 is the VCF Identity Broker, which can only be installed after VCF Operations, SDDC Manager and the management domain vCenter are on 9.0. So this procedure still matters for anyone running Aria 8.x or a mixed environment during migration.

Before you start

  • A user with the certificate administrator role in Aria Suite Lifecycle.
  • SANs covering every name clients use: for a cluster the load balancer FQDN plus all node FQDNs (enter several names comma separated in the CSR form).
  • Backups or non-memory snapshots of vIDM and the dependent appliances. Remove the snapshots when you are done.
  • All vIDM nodes healthy. For vIDM 3.3.7 errors during the operation, Broadcom points to KB 94095.

Replace the vIDM certificate with Aria Suite Lifecycle 8.18

  1. Generate the CSR. Locker > Certificates > Generate CSR. Fill in the subject fields and all domain names, download the .pem. It contains the CSR and the private key, so store it safely.
  2. Get it signed. Submit the CSR to your CA (for example Microsoft AD CS) and download the certificate and chain in Base64.
  3. Import into Locker. Locker > Certificates > Import. Paste the private key and the certificate chain (server certificate first, then intermediates and root).
  4. Snapshot. Lifecycle Operations > Environments > globalenvironment > View Details > … > Snapshot > Create Snapshot.
  5. Replace. In the same environment, click … on the VMware Identity Manager row and select Replace Certificate. Review the current certificate, pick the new one from Locker.
  6. Re-trust. On the Retrust Product Certificate page select all impacted products and tick Opt-in for Snapshot.
  7. Precheck and submit. Run Precheck, fix any findings, click Finish, and follow the request under Requests.

You can check the chain before importing with OpenSSL:

# chain validates against the CA bundle
openssl verify -CAfile root-and-intermediate.pem vidm-server.pem

# private key matches the certificate (hashes must be identical)
openssl x509 -noout -modulus -in vidm-server.pem | openssl md5
openssl rsa  -noout -modulus -in vidm.key       | openssl md5

# SANs present
openssl x509 -noout -ext subjectAltName -in vidm-server.pem

Clustered vIDM and the load balancer

Aria Suite Lifecycle replaces the certificate on all cluster nodes, but not on the load balancer. Per KB 372708, import the CA and server certificate on the load balancer first (for NSX: Networking > Load Balancing > Virtual Servers > SSL Configuration), apply it, run the re-trust with the load balancer in Aria Suite Lifecycle, and only then replace the node certificates.

vIDM certificate already expired

Typical symptoms are LCMVIDM71059 with 401 Unauthorized, ERR_CERT_DATE_INVALID in the browser, redirect loops to /hc/error, or “No healthy upstream”. Aria Suite Lifecycle can no longer talk to vIDM, so KB 372708 describes pasting the chain and key on each node at https://<vidm-node-fqdn>:8443/cfg/ssl. Afterwards, in Aria Suite Lifecycle run Inventory Sync and Re-Trust with Identity Manager on Aria Automation, and Re-Register Identity Manager if logins still fail.

A similar “expired certificate breaks SSO” pattern exists on vCenter: see vCenter STS signing certificate expiration. For vSphere-side certificate work, the vCert tool is useful.

Further reading

Author: Daniel Micanek

Senior Service Architect, SAP/TDL Platform Services Team at Vivicta | vExpert ⭐⭐⭐⭐⭐⭐⭐ | Broadcom Knight: vSphere Kubernetes Service, VCF Networking (NSX), VCF Automation | Broadcom Software Knight: vSphere | Cisco Champion. Notes from running about 1,000 ESXi hosts on Cisco UCS, VCF 9 and SAP HANA on vSphere.