Loading...
Loading...
In some situations, it is necessary to manually import the SSL certificates in vCenter after VxRail initial deployment.
Replacing vCenter SSL self-signed certificate with a previously owned certificate.
A Python script is attached to this article in a .zip file (check the bottom of the article) to provide the importing process. Run this script AS ROOT on VxRail Manager, and use --help to obtain usage. Remove the script after use. The script works on VxRail versions 4.5.x, 4.7.x, 7.x, and 8.x. The script in this article has been updated. Starting from version 7.0.480, the script has been added into VxRail Manager at /mystic/ssl/cert_util.py . You can run this script directly. Follow these steps to replace certificates on VxRail Manager: Download the python script cert_util_pkb.zip and upload it to VxRail Manager. You must now use SSH to log in to VxRail Manager and switch to ROOT user. Extract the cert_util_pkb.zip script: # unzip cert_util_pkb.zip Run the script: # python cert_util.py Wait for the VxRail plug-in UI to load. It may take up to ten minutes for the UI to be read. Example script output: vxm:/home/mystic # python cert_util.py Verify certificate against vCenter vcluster101-vcsa.vv003.local Downloaded root CA certificate zip to /tmp/tmpw2w8j7_r Downloaded root CA certificate zip from vcluster101-vcsa.vv003.local Found certificates ['certs/lin/53f38aa6.0', 'certs/lin/53f38aa6.r0'] that can verify server certificate Clean up existing certificates in /var/lib/vmware-marvin/trust/ - Removing /var/lib/vmware-marvin/trust/lin/53f38aa6.r0 - Removing /var/lib/vmware-marvin/trust/lin/53f38aa6.0 Clean up existing crl files in /var/lib/vmware-marvin/trust/crl/ Root CA certificate /tmp/certs/lin is saved at /var/lib/vmware-marvin/trust/. Remove /tmp/certs directory. Delete saved CRL info in cacheservice... 1 1 Restarting vmware-marvin service... Restarting runjars service... For version 8.0.380 and later, use the newer version of the script: cert_util.260822.pyc (this might work with old versions too but is not formally tested.) It is enhanced to present an interactive menu if no options given: # python3.11 /home/mystic/bin/cert_util.260822.pyc Running script with version 2026.08.22====================================================================== VxRail Cert Utility - 2026.08.22 ======================================================================System Information: VxRail Version: 8.0.380 vCenter FQDN/IP: vc.vcenter.local VxRail Manager FQDN/IP: 10.20.20.20 vCenter Management User: vxrmmgmt@vsphere.local Log File: /var/log/mystic/vxrail_cert_util.logAvailable Operations: 1) Import vCenter Root CA certificates to VxRail Manager 2) VxRail Manager Certificate Replace 3) Re-register VxRail plugin in vCenter 4) Diagnose certificate and plugin status (read-only) 0) Exit ======================================================================Select operation [0-4, q to quit]: 2====================================================================== VxRail Manager Certificate Replace ======================================================================Select certificate replacement method: 1) Regenerate VxRail Manager self-signed certificate 2) Import custom certificate for VxRail Manager 0) Return to main menu q) Quit ======================================================================Select option [0-2, q to quit]: Import vCenter certificates: python3.11 /home/mystic/bin/cert_util.260822.pyc -i Regenerate VxM certificate and re-register plugin (uses existing lockbox credentials): python3.11 /home/mystic/bin/cert_util.260822.pyc -r Re-register plugin only: python3.11 /home/mystic/bin/cert_util.260822.pyc -p Full help information: python3.11 /home/mystic/bin/cert_util.260822.pyc usage: cert_util_new.py [-h] [-r] [-i] [-p] [-d] [-l LOGFILE] VxRail Manager certificate utility tool - Mani Vasagan [2026.08.22] optional arguments: -h, --help show this help message and exit -r, --regencert Regenerate VxRail Manager self signed cert. -i, --vc_import Import vCenter Root CA certificates to VxRail Manager. -p, --reregister_plugin Re-register VxRail plugin in vCenter (without regenerating cert). -d, --diagnose Diagnose certificate and plugin status (read-only). -l LOGFILE, --logfile LOGFILE Log file path.
Click on a version to see all relevant bugs
Dell Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.