{"id":380,"date":"2022-05-23T17:30:18","date_gmt":"2022-05-23T14:30:18","guid":{"rendered":"http:\/\/yusufziyagulec.com\/blog\/?p=380"},"modified":"2022-05-24T16:41:54","modified_gmt":"2022-05-24T13:41:54","slug":"vcenter-ssl-sertifikasi-degistirme","status":"publish","type":"post","link":"https:\/\/yusufziyagulec.com\/blog\/vcenter-ssl-sertifikasi-degistirme\/","title":{"rendered":"vCenter SSL (Machine SSL Certificate) sertifikas\u0131 de\u011fi\u015ftirme"},"content":{"rendered":"<p>Baz\u0131 organizasyonlarda vCenter taraf\u0131ndan kullan\u0131lan SSL sertifikas\u0131n\u0131n g\u00fcvenlik gere\u011fi \u00fc\u00e7\u00fcnc\u00fc parti bir sertifika otoritesi (Certificate Authority \/ CA) taraf\u0131ndan imzalanm\u0131\u015f bir SSL sertifikas\u0131 ile de\u011fi\u015ftirilmesi gerekebilir.<\/p>\n<p>vCenter sertifika de\u011fi\u015fimi a\u015fa\u011f\u0131daki \u015fekilde yap\u0131l\u0131r (T\u00fcm i\u015flemler vCenter 7.0 \u00fczerinde yap\u0131lm\u0131\u015ft\u0131r):<\/p>\n<p>1- \u00d6ncelikle vCenter&#8217;dan CA&#8217;e iletmek \u00fczere bir CSR olu\u015fturmam\u0131z gerekiyor. CSR \u00fcretmek i\u00e7in \u00fc\u00e7 farkl\u0131 y\u00f6ntem kullan\u0131labilir:<\/p>\n<ul>\n<li>vCenter GUI \u00fczerinden<em><strong> Administration &#8211;&gt; Certificate Management<\/strong><\/em> \u00fczerinden CSR olu\u015fturma.<\/li>\n<li>vCenter SSH \u00fczerinden\u00a0<em><b>\/usr\/lib\/vmware-vmca\/bin\/certificate-manager<\/b><\/em> kullanarak CSR olu\u015fturma.<\/li>\n<li>OpenSSL kullanarak CSR olu\u015fturma.<\/li>\n<\/ul>\n<p>Halihaz\u0131rda ilk iki y\u00f6ntem dururken neden OpenSSL&#8217;i kullanal\u0131m diyebilirsiniz. Maalesef hem GUI hem de SSH \u00fczerindeki tool&#8217;lar yeterli seviyede \u00f6zelle\u015ftirilebilir de\u011fil.<\/p>\n<p>\u00d6rne\u011fin bizim ortam\u0131m\u0131zdaki CA portali ilk iki y\u00f6ntemle olu\u015fturdu\u011fumuz CSR&#8217;lar\u0131 kabul etmedi. GUI&#8217;den denedi\u011fimizde CA ve host ismi ayn\u0131 oldu\u011fu i\u00e7in duplicate FQDN hatas\u0131 ald\u0131k. GUI&#8217;de CA ve host alanlar\u0131 &#8220;zorunlu&#8221; oldu\u011fundan mecburen doldurmak zorundayd\u0131k ancak CA bu CSR&#8217;\u0131 kabul etmedi.<\/p>\n<p>SSH \u00fczerinden\u00a0 denedi\u011fimizde ise encryption key size&#8217;\u0131 CA&#8217;in istedi\u011fi \u015fekilde (4096 bit) olarak olu\u015fturamad\u0131k. vCenter&#8217;\u0131n bu tool&#8217;u key size&#8217;\u0131 de\u011fi\u015ftirmeye izin vermiyor. T\u00fcm bu nedenlerle OpenSSL ile sertifika olu\u015fturmak zorunda kald\u0131k.<\/p>\n<p><strong>OpenSSL kullanarak CSR olu\u015fturma<\/strong><\/p>\n<p>vCenter&#8217;a SSH ba\u011flant\u0131s\u0131 yap\u0131l\u0131r ve \u015fu komut \u00e7al\u0131\u015ft\u0131r\u0131l\u0131r:<\/p>\n<p><em>openssl req -out vcenter.csr -new -newkey rsa:4096 -keyout vcenter.key<\/em><\/p>\n<p>bu komutun \u00e7\u0131kt\u0131s\u0131 bize iki adet dosya \u00fcretir:<\/p>\n<ul>\n<li><strong>CSR dosyam\u0131z (vcenter.csr)<\/strong> &#8211;&gt; Bu dosyay\u0131 SSL sertifikas\u0131n\u0131 alaca\u011f\u0131m\u0131z CA&#8217;e iletiyoruz.<\/li>\n<li><strong>Private Key (vcenter.key)<\/strong> &#8211;&gt; Bu dosyay\u0131 <em><strong>openssl rsa -in vcenter.key -check<\/strong><\/em> komutuyla a\u00e7\u0131p i\u00e7eri\u011fini metin edit\u00f6r\u00fcne kopyal\u0131yoruz.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-391 size-full\" src=\"http:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/vcenter-sertifika-degisimi-certificate-3.jpg\" alt=\"\" width=\"402\" height=\"515\" srcset=\"https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/vcenter-sertifika-degisimi-certificate-3.jpg 402w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/vcenter-sertifika-degisimi-certificate-3-234x300.jpg 234w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/vcenter-sertifika-degisimi-certificate-3-150x192.jpg 150w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/vcenter-sertifika-degisimi-certificate-3-400x512.jpg 400w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/vcenter-sertifika-degisimi-certificate-3-200x256.jpg 200w\" sizes=\"auto, (max-width: 402px) 100vw, 402px\" \/><\/p>\n<p><em>vcenter.csr<\/em> dosyas\u0131n\u0131 CA&#8217;a ilettikten sonra CA bize SSL sertifikas\u0131n\u0131 iletecektir (Biz 3.parti bir sa\u011flay\u0131c\u0131dan sertifika ald\u0131k ancak e\u011fer ortamda mevcutsa Microsoft CA Server da kullan\u0131labilirdi). SSL sertifika zinciri CA taraf\u0131ndan kullan\u0131lan Root ve Intermediate sertifikalar\u0131 da i\u00e7erecektir. Bu sertifikalar\u0131 export ederek i\u00e7eriklerini metin d\u00fczenleyiciye aktarmak gerekiyor. Bu i\u015flemi Windows&#8217;un Certificate Manager snap-in&#8217;ini kullanarak yapabilirsiniz.<\/p>\n<p>\u015eimdi elimizde 4 adet dosya bulunmal\u0131:<\/p>\n<ul>\n<li>SSL sertifikas\u0131<\/li>\n<li>Intermediate sertifika<\/li>\n<li>Root sertifika<\/li>\n<li>Private key<\/li>\n<\/ul>\n<p>Art\u0131k sertifikam\u0131z\u0131 vCenter&#8217;a import etme a\u015famas\u0131na ge\u00e7ebiliriz.<\/p>\n<p><em>Administration &#8211;&gt; Certificate Management &#8211;&gt; Machine SSL Certificate &#8211;&gt; Import and Replace Certificate &#8211;&gt; Replace with external CA certificate(requires private key)<\/em> se\u00e7ene\u011fi ile ilerliyoruz. (CSR&#8217;\u0131 OpenSSL yerine direkt olarak vCenter \u00fczerinden direkt olarak \u00fcretmi\u015f olsayd\u0131k ikinci se\u00e7enek olan <em>Replace with external CA certificate where CSR is generated from vCenter Server (private key embedded)<\/em> ile devam edecektik.)<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-392 size-full\" src=\"http:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate.png\" alt=\"\" width=\"916\" height=\"221\" srcset=\"https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate.png 916w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-300x72.png 300w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-768x185.png 768w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-500x121.png 500w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-150x36.png 150w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-400x97.png 400w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-800x193.png 800w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacevCenterServerCertificate-200x48.png 200w\" sizes=\"auto, (max-width: 916px) 100vw, 916px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-394 size-full\" src=\"http:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey.jpg\" alt=\"\" width=\"919\" height=\"707\" srcset=\"https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey.jpg 919w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-300x231.jpg 300w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-768x591.jpg 768w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-500x385.jpg 500w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-150x115.jpg 150w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-400x308.jpg 400w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-800x615.jpg 800w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/ReplacewithExternallySignedCertificateandPrivateKey-200x154.jpg 200w\" sizes=\"auto, (max-width: 919px) 100vw, 919px\" \/><\/p>\n<p>Yukar\u0131daki ekranda;<\/p>\n<p><strong>&#8211;&gt; Machine SSL Certificate alan\u0131na<\/strong><\/p>\n<ul>\n<li>SSL sertifikas\u0131<\/li>\n<\/ul>\n<p><strong>&#8211;&gt; Chain of trusted root certificates alan\u0131na;<\/strong><\/p>\n<ul>\n<li>Intermediate sertifika<\/li>\n<li>Root sertifika<\/li>\n<\/ul>\n<div id=\"attachment_401\" style=\"width: 317px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-401\" class=\"size-full wp-image-401\" src=\"https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/RootCertIntermediateCert.png\" alt=\"\" width=\"307\" height=\"531\" srcset=\"https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/RootCertIntermediateCert.png 307w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/RootCertIntermediateCert-173x300.png 173w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/RootCertIntermediateCert-150x259.png 150w, https:\/\/yusufziyagulec.com\/blog\/wp-content\/uploads\/2022\/05\/RootCertIntermediateCert-200x346.png 200w\" sizes=\"auto, (max-width: 307px) 100vw, 307px\" \/><p id=\"caption-attachment-401\" class=\"wp-caption-text\"><em><strong>Intermediate ve Root sertifikalar\u0131 arka arkaya ekledi\u011finizde buna benzer \u015fekilde g\u00f6r\u00fcnmeli<\/strong><\/em><\/p><\/div>\n<p><strong>&#8211;&gt; Private Key alan\u0131na<\/strong><\/p>\n<ul>\n<li>Private key<\/li>\n<\/ul>\n<p>dosyan\u0131z\u0131n i\u00e7eri\u011fini eklemelisiniz.<\/p>\n<p>T\u00fcm ad\u0131mlar\u0131 eksiksiz yapt\u0131ysan\u0131z sertifika de\u011fi\u015fimi ba\u015far\u0131yla ger\u00e7ekle\u015fecek ve vCenter otomatik olarak yeniden ba\u015flayacakt\u0131r. Art\u0131k vCenter eri\u015fiminde yeni SSL sertifikan\u0131z\u0131 kullanabileceksiniz.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Baz\u0131 organizasyonlarda vCenter taraf\u0131ndan kullan\u0131lan SSL sertifikas\u0131n\u0131n g\u00fcvenlik gere\u011fi \u00fc\u00e7\u00fcnc\u00fc parti bir sertifika otoritesi (Certificate Authority \/ CA) taraf\u0131ndan imzalanm\u0131\u015f bir SSL sertifikas\u0131 ile de\u011fi\u015ftirilmesi gerekebilir. vCenter sertifika de\u011fi\u015fimi a\u015fa\u011f\u0131daki \u015fekilde yap\u0131l\u0131r (T\u00fcm i\u015flemler vCenter 7.0 \u00fczerinde yap\u0131lm\u0131\u015ft\u0131r): 1- \u00d6ncelikle vCenter&#8217;dan CA&#8217;e iletmek \u00fczere bir CSR olu\u015fturmam\u0131z gerekiyor. CSR \u00fcretmek i\u00e7in \u00fc\u00e7 farkl\u0131 y\u00f6ntem kullan\u0131labilir:&#8230; <a class=\"more-link\" href=\"https:\/\/yusufziyagulec.com\/blog\/vcenter-ssl-sertifikasi-degistirme\/\">Continue reading <span class=\"meta-nav\">&#8594;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43],"tags":[129,147,145,146,141,9,8,148],"class_list":["post-380","post","type-post","status-publish","format-standard","hentry","category-vmware-2","tag-ca","tag-machinessl","tag-openssl","tag-rootca","tag-ssl","tag-vcenter","tag-vmware","tag-vxrail"],"_links":{"self":[{"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/posts\/380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/comments?post=380"}],"version-history":[{"count":13,"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/posts\/380\/revisions"}],"predecessor-version":[{"id":402,"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/posts\/380\/revisions\/402"}],"wp:attachment":[{"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/media?parent=380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/categories?post=380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yusufziyagulec.com\/blog\/wp-json\/wp\/v2\/tags?post=380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}