替换esxi主机SSL证书

ESXi主机SSL证书更换全流程

最新推荐文章于 2025-10-15 14:23:04 发布

原创最新推荐文章于 2025-10-15 14:23:04 发布 · 1.5k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#esxi ssl #esxi ssl更改

Virtualization 同时被 2 个专栏收录

15 篇文章

订阅专栏

VCAP-DCA学习

1 篇文章

订阅专栏

本文档详细介绍了如何在ESXi主机上生成证书请求文件并申请SSL证书，包括使用Microsoft CA和OpenSSL CA的方式。之后，通过SSH上传证书到ESXi主机并重启管理进程，以完成SSL证书的更换。参照VMware KB文章进行操作，可以确保过程顺利。

部署运行你感兴趣的模型镜像

ESXi主机SSL证书更换

1、生成证书请求文件rui.csr及私钥rui.key

a、创建esxi.cfg文件内容如下：

[ req ]

default_bits = 2048

default_keyfile = rui.key

distinguished_name = req_distinguished_name

encrypt_key = no

prompt = no

string_mask = nombstr

req_extensions = v3_req

[ v3_req ]

basicConstraints = CA:FALSE

keyUsage = digitalSignature, keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth, clientAuth

subjectAltName = DNS:esxi-dell, DNS:192.168.191.23, DNS:esxi-dell.demo-cq.cn

[ req_distinguished_name ]

countryName = CN

stateOrProvinceName = ChongQing

localityName = CQ

0.organizationName = Demo-cq, Inc

organizationalUnitName = esxi-dell

commonName = esxi-dell.demo-cq.cn

b、openssl req -new -nodes -out rui.csr -keyout rui-orig.key -config esxi.cfg

c、Convert the Key to be in RSA format by running the following command:

openssl rsa -in rui-orig.key -out rui.key

2、向使用证书请求文件rui.csr向CA申请证书rui.crt

a、使用Microsoft CA

For Microsoft CAs:

Note: For Windows Server 2003 CA's, Enterprise edition is required. Other Windows Server 2003 editions do not have the correct templates for exporting a valid SSL certificate.

Log in to the Microsoft CA certificate authority web interface. By default, it is http://<servername>/CertSrv/
Click Request a certificate.
Click advanced certificate request.
Click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
Open the certificate request in a plain text editor.
Copy from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST----- into the Saved Request box.
Click Web Server when selecting the Certificate Template.
Click Submit to submit the request.
Click Base 64 encoded on the Certificate issued screen.
Click Download Certificate.
Save the certificate on the desktop of the server as rui.crt. When complete, proceed to Installing and configuring the certificate on the ESXi host to complete the configuration of the custom certificate.