2. vCenter SSH Shell\uc5d0\uc11c \uc804\uccb4 \uc778\uc99d\uc11c \uae30\uac04 \ud655\uc778 \uba85\ub839\uc5b4
2.1 WEB GUI\uc758 \ud1b5\ud569 SSO \ub85c\uadf8\uc778\uc740 \ub418\uc9c0 \uc54a\ub354\ub77c\ub3c4 ESXi\ub97c \ud1b5\ud574 vCenter\ub85c \ub610\ub294 SSH\ub97c \ud1b5\ud574 vCenter\uc73c\ub85c
\uc811\uc18d\uc740 \uac00\ub2a5. \uc811\uc18d\ud558\uc5ec \uc544\ub798 \uba85\ub839\uc5b4\ub85c MACHINE_CERT \uc778\uc99d\uc11c \uae30\uac04\uc744 \ud655\uc778.<\/p>\n\n\n\n
root@localhost [ ~ ]# for store in $(\/usr\/lib\/vmware-vmafd\/bin\/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; \/usr\/lib\/vmware-vmafd\/bin\/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;\n[*] Store : MACHINE_SSL_CERT\nAlias : __MACHINE_CERT\n Not After : Apr 22 12:45:45 2026 GMT\n[*] Store : TRUSTED_ROOTS\nAlias : 187cae902f08cd8010acab1c4ad429c300608556\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : machine\nAlias : machine\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : vsphere-webclient\nAlias : vsphere-webclient\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : vpxd\nAlias : vpxd\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : vpxd-extension\nAlias : vpxd-extension\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : hvc\nAlias : hvc\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : data-encipherment\nAlias : data-encipherment\n Not After : Apr 17 00:45:44 2034 GMT\n[*] Store : APPLMGMT_PASSWORD\n[*] Store : SMS\nAlias : sms_self_signed\n Not After : Apr 22 00:51:49 2034 GMT\n[*] Store : wcp\nAlias : wcp\n Not After : Apr 17 00:45:44 2034 GMT\n<\/code><\/pre><\/div>\n\n\n\n 2.2 MACHINE_SSL \uc815\ubcf4 \ud655\uc778 (WEB UI \ub85c\uadf8\uc778 \uad00\ub828\ud558\uc5ec MACHINE_SSL \uc0ac\uc6a9, \uae30\ubcf8 2\ub144)<\/p>\n\n\n\n
root@localhost [ ~ ]# \/usr\/lib\/vmware-vmafd\/bin\/vecs-cli entry list --store MACHINE_SSL_CERT --text\nNumber of entries in store : 1\nAlias : __MACHINE_CERT\nEntry type : Private Key\nCertificate:\n Data:\n Version: 3 (0x2)\n Serial Number:\n d3:c3:d1:e8:19:xx:xx:xx\n Signature Algorithm: sha256WithRSAEncryption\n Issuer: CN=CA, DC=vsphere, DC=local, C=US, ST=California, O=localhost, OU=VMware Engineering\n Validity\n Not Before: Apr 22 00:45:45 2024 GMT\n Not After : Apr 22 12:45:45 2026 GMT\n Subject: CN=192.168.123.123, C=US\n Subject Public Key Info:\n Public Key Algorithm: rsaEncryption\n Public-Key: (2048 bit)\n Modulus:\n 00:b6:a0:23:89:bd:d7:ac:13:ab:4b:a6:fd:7e:9b:\n ce:41:7f:c6:6f:6a:4a:d1:67:15:9a:e5:b0:49:8b:\n e3:2c:75:86:3a:1f:61:ba:e3:d4:35:15:3d:60:72:\n.......(\uc0dd\ub7b5)<\/code><\/pre><\/div>\n\n\n\n 2.3 VMCA \uc778\uc99d\uc11c \uc124\uc815\uac12 \ud655\uc778<\/p>\n\n\n\n
oot@localhost [ ~ ]# cat \/usr\/lib\/vmware-vmca\/share\/config\/certool.cfg\n\t\t#\n\t\t# Template file for a CSR request\n\t\t#\n\t\t\n\t\t# Country is needed and has to be 2 characters\n\t\tCountry = US\n\t\tName = CA\n\t\tOrganization = VMware\n\t\tOrgUnit = VMware Engineering\n\t\tState = California\n\t\tLocality = Palo Alto\n\t\tIPAddress = 127.0.0.1\n\t\tEmail = email@acme.com -> \ud544\uc694\n\t\tHostname = server.acme.com -> \ud544\uc694\n\t\t\n\t\troot@localhost [ ~ ]# hostname -f\n\t\tlocalhost -> \ud544\uc694\n\t\troot@localhost [ ~ ]# \/usr\/lib\/vmware-vmafd\/\/bin\/vmafd-cli get-pnid --server-name localhost\n\t\t192.168.123.123 -> \ud544\uc694\nroot@localhost [ ~ ]#<\/code><\/pre><\/div>\n\n\n\n3. \uc778\uc99d\uc11c \uad00\ub9ac\uc790\ub97c \ud1b5\ud574 \uac31\uc2e0(\uc0ac\uc6a9\uae30\ud55c expire\ub41c \uacbd\uc6b0)
# \/usr\/lib\/vmware-vmca\/bin\/certificate-manager<\/p>\n\n\n\n![\"\"](\"http:\/\/www.iwgh.my\/wp-content\/uploads\/2025\/02\/image-1.png\")
<\/figure>\n\n\n\n“3” MACHINE SSL \uac31\uc2e0 \uc7ac\ubc1c\ud589. STS \uc778\uc99d\uc11c\uac00 \uc720\ud6a8\ud55c \uacbd\uc6b0.
“8” \ubaa8\ub4e0 \uc778\uc99d\uc11c \ucd08\uae30\ud654
-> \uc2e4\uc81c MACHINE SSL \uc774 \ub9cc\ub8cc\ub41c \uacbd\uc6b0 8\ubc88 \uc73c\ub85c \uc804\uccb4 \ucd08\uae30\ud654 \uc774\ud6c4 \uc815\uc0c1 \uc791\ub3d9 \uc548\ub428.<\/p>\n\n\n\n
\uc774\ud6c4 3\ubc88\uc73c\ub85c MACHINE_SSL \ub9cc \uc7ac\ubc1c\ud589 \uc774\ud6c4 \uc811\uc18d \uc815\uc0c1. \uac31\uc2e0\uc2dc \uc785\ub825\uac12 \uc774\uc288\uc778\uc9c0<\/p>\n\n\n\n
“3”\ubc88\ub9cc \ud544\uc694\ud55c\uc9c0, “8”->”3″ \uacfc\uc815\uc774 \ud544\uc694\ud55c\uc9c0 \ud655\uc778 \ud544\uc694.<\/p>\n\n\n\n
4. MACHINE_SSL \ub9cc \uc7ac\ubc1c\ud589
“Replace Machine SSL certificate with VMCA Certificate” \uc120\ud0dd. \uc774\ud6c4 \uc815\ubcf4 \uc785\ub825 \uc608<\/p>\n\n\n\n
\tOption[1 to 8]: 3\n\t\n\tPlease provide valid SSO and VC privileged user credential to perform certificate operations.\n\tEnter username [Administrator@vsphere.local]:administrator@vsphere.local\n\tEnter password:\n\tcertool.cfg file exists, Do you wish to reconfigure : Option[Y\/N] ? : y\n\tPress Enter key to skip optional parameters or use Previous value.\n\tEnter proper value for 'Country' [Previous value : US] : \n\tEnter proper value for 'Name' [Previous value : CA] : \n\tEnter proper value for 'Organization' [Previous value : VMware] : \n\tEnter proper value for 'OrgUnit' [Previous value : VMware Engineering] : \n\tEnter proper value for 'State' [Previous value : California] : \n\tEnter proper value for 'Locality' [Previous value : Palo Alto] : \n\tPlease enter IP addresses separated by comma in valid IPV4 or IPV6 format\n\tEnter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) : 192.168.100.200 -> \uc774\uc804 \uc815\ubcf4 \ucc38\uc870\n\tEnter proper value for 'Email' [Previous value : email@acme.com] : email@acme.com -> \uc774\uc804 \uc815\ubcf4 \ucc38\uc870\n\tEnter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : server.acme.com\n\tEnter proper value for VMCA 'Name' :localhost -> \uc774\uc804 \uc815\ubcf4 \ucc38\uc870\n\tYou are going to regenerate Machine SSL cert using VMCA\n\tContinue operation : Option[Y\/N] ? : y\n\tStatus : 0% Completed [Replacing Machine SSL Cert...] \n\t.....\n\tStatus : 70% Completed [stopping services...] \n\tStatus : 85% Completed [starting services...] \n\tStatus : 100% Completed [All tasks completed successfully]\n<\/code><\/pre><\/div>\n\n\n\n5. \uc804\uccb4 \uc11c\ube44\uc2a4 \uc7ac\uc2dc\uc791 \ubc0f \uc815\uc0c1 \ub85c\uadf8\uc778 \ud655\uc778.<\/p>\n","protected":false},"excerpt":{"rendered":"
** \uc778\uc99d\uc11c \ub9cc\ub8cc\ud6c4 \uac31\uc2e0\uc2dc \uc77c\ubd80 \uc11c\ube44\uc2a4\uac00 \uc815\uc0c1\uc801\uc73c\ub85c \uc7ac\uc2dc\uc791\ub418\uc9c0 \uc54a\uc744 \uc218 \uc788\uc74c. \ub9cc\ub8cc\uc804 \ubbf8\ub9ac \ud655\uc778 \ud544\uc694. vCenter Server\uc5d0 \ub85c\uadf8\uc778\uc774 \uac00\ub2a5\ud558\ub2e4\uba74 (\ud648 – \uad00\ub9ac – \uc778\uc99d\uc11c – […]<\/p>\n","protected":false},"author":1,"featured_media":482,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[76,28,131,130,132],"class_list":["post-481","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech","tag-certificate","tag-throuble-shooting","tag-vcenter","tag-vcsa","tag-vmware"],"_links":{"self":[{"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/posts\/481","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=481"}],"version-history":[{"count":2,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/posts\/481\/revisions"}],"predecessor-version":[{"id":486,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/posts\/481\/revisions\/486"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=\/wp\/v2\/media\/482"}],"wp:attachment":[{"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=481"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=481"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/iwgh.duckdns.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=481"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/www.iwgh.my\/wp-content\/uploads\/2025\/02\/image-1024x369.png\")
<\/figure>\n\n\n\n