Dans ce script, j’utiliser ACME.sh pour générer les certificats avec une autre machine et je pose les clés en SSH sur le vCenter.
A vous d’adapter les emplacements en fonction de vos besoins.
Voici le script :
[pastacode lang= »markup » manual= »%23!%2Fbin%2Fbash%0A%0A%23%20Il%20faut%20en%20amont%20de%20ce%20script%20g%C3%A9n%C3%A9rer%20les%20certificats%20avec%20ACME.SH%0A%23%20Puis%20copier%20le%20dossier%20d’ACME.SH%20vers%20%2Froot%0A%23%20Et%20appeler%20le%20script%0A%0AADMIN_VCENTER%3D’administrator%40vsphere.local’%0APASSWORD_ADMIN_VCENTER%3D’LOGIN%20ADMIN’%0AFQDN_VCENTER%3D’VOTRE%20FQDN’%0A%0A%23%20Mise%20%C3%A0%20jour%20du%20certificat%20dans%20le%20magasin%0A%0ACERT_FILE_PATH%3D%22%2Froot%2F%24FQDN_VCENTER%2Ffullchain.cer%22%0AKEY_FILE_PATH%3D%22%2Froot%2F%24FQDN_VCENTER%2F%24FQDN_VCENTER.key%22%0AOLD_CERT_PATH%3D%22%2Froot%2F%24FQDN_VCENTER%2Fold_cert.crt%22%0A%0Aif%20!%20%5B%20-e%20%24CERT_FILE_PATH%20%5D%3B%20then%0A%09exit%0Afi%0A%0Aif%20!%20%5B%20-e%20%24KEY_FILE_PATH%20%5D%3B%20then%0A%09exit%0Afi%0A%0Aservice-control%20–stop%20–all%0Aservice-control%20–start%20vmafdd%0Aservice-control%20–start%20vmdird%0Aservice-control%20–start%20vmcad%0A%0A%2Fusr%2Flib%2Fvmware-vmafd%2Fbin%2Fvecs-cli%20entry%20delete%20–store%20MACHINE_SSL_CERT%20–alias%20__MACHINE_CERT%20-y%0A%2Fusr%2Flib%2Fvmware-vmafd%2Fbin%2Fvecs-cli%20entry%20create%20–store%20MACHINE_SSL_CERT%20–alias%20__MACHINE_CERT%20–cert%20%22%24CERT_FILE_PATH%22%20–key%20%22%24KEY_FILE_PATH%22%0A%0Aservice-control%20–start%20–all%0A%0A%23%20Mise%20%C3%A0%20jour%20de%20l’emprunt%20du%20certificat%0A%0AOLD_KEY%3D%24(%2Fusr%2Flib%2Fvmidentity%2Ftools%2Fscripts%2Flstool.py%20list%20–url%20https%3A%2F%2Flocalhost%2Flookupservice%2Fsdk%20–no-check-cert%20–ep-type%20com.vmware.cis.cs.identity.sso%202%3E%2Fdev%2Fnull%20%7C%20grep%20trust%20%7C%20cut%20-d%3A%20-f2%20%7C%20sed%20’s%2F%20%2F%2Fg’)%0ABEGIN%3D%22—–BEGIN%20CERTIFICATE—–%22%0AEND%3D%22—–END%20CERTIFICATE—–%22%0Aecho%20%24BEGIN%20%3E%20%24OLD_CERT_PATH%20%26%26%20echo%20%24OLD_KEY%20%3E%3E%20%24OLD_CERT_PATH%20%26%26%20echo%20%24END%20%3E%3E%20%24OLD_CERT_PATH%0A%0AOLD_FINGERPRINT%3D%24(openssl%20×509%20-in%20%24OLD_CERT_PATH%20-noout%20-sha1%20-fingerprint%20%7C%20cut%20-d’%20’%20-f2%20%7C%20cut%20-d’%3D’%20-f2)%0A%0Acd%20%2Fusr%2Flib%2Fvmidentity%2Ftools%2Fscripts%2F%0Apython%20ls_update_certs.py%20–url%20https%3A%2F%2F%24FQDN_VCENTER%2Flookupservice%2Fsdk%20–fingerprint%20%22%24OLD_FINGERPRINT%22%20–certfile%20%22%24CERT_FILE_PATH%22%20–user%20%22%24ADMIN_VCENTER%22%20–password%20%22%24PASSWORD_ADMIN_VCENTER%22%0Acd%20%2Froot%2F%0Arm%20old_cert.crt » message= » » highlight= » » provider= »manual »/]
Vous pouvez faire une tache cron ou appeler le script en SSH après avoir poussé les certificats généré avec ACME.sh
Vous pouvez aussi utiliser les commandes POST HOOK de ACME.sh pour appeler vos scripts pour pousser et lancer le renouvellement sur votre vCenter.