View source for Lab:Use OpenSSL to generate the Certificate Signing Request (CSR) for VMware NSX (with multiple SANs)

<div class="page-body">
In this lab I am working with the following software and versions:

{| class="wikitable simple-table"
|-
! Software
! Version
! Filename
|-
| VMware NSX
| 4.0.0.1
| nsx-unified-appliance-4.0.0.1.0.20159694.ova
|-
| Windows Server
| 2019
| en_windows_server_2019_updated_feb_2020_x64_dvd_de383770.iso
|-
| OpenSSL
| 1.1.1q
| Win64OpenSSL_Light-1_1_1q.exe
|-
| Visual C++ Redistributable Packages 2017
| 14.16.27033
| VC_redist.x64.exe
|}

# Create a “wildcard” CSR that can be used to sign and that can be used for all NSX Manager Nodes including the NSX Manager VIP address.

<div id="8dce32de-b760-4e75-9017-785e623801e2" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled.png

</div>
⚠️ You can not use the NSX Manager to generate a new CSR that are usable for the signing and replacement of CA signed certificates. The NSX Manager does not provides the private key with the CSR. This private key is required later in this [https://www.iwanhoogendoorn.nl/index.php/Lab:_Replacing_the_self-signed_SSL_certificates_with_CA-signed_certificates step]. For this reason you need to use another tool to generate the CSR. I am using OpenSSL in this article.

<span id="0d32cd91-e27e-4ec3-9a2c-6a046241bf44"></span>
= The Steps =

*<span class="far fa-regular fa-square"> STEP 1: Install OpenSSL and Visual C++ Redistributable Packages</span>
*<span class="far fa-regular fa-square"> STEP 2: Create a the certificate config file</span>
*<span class="far fa-regular fa-square"> STEP 3: Use OpenSSL to generate the .csr and .key file</span>
<div class="indented">


<span id="b475ee42-9616-4a2e-9884-b213c298ecd4"></span>
= STEP 1: Install OpenSSL and Visual C⏆⏆ Redistributable Packages =

<span id="95b6e221-c9f6-41a1-b3dd-01db9337168c"></span>
== Visual C⏆⏆ Redistributable Packages ==

Agree on the license terms and conditions and click “Install”.

<div id="71052c57-02ea-4ac2-8a44-960645ba3a21" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%201.png

</div>
Review the progress.

<div id="28282924-5d1b-485a-a9fd-806f2cc19766" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%202.png

</div>
Click on “

<div id="a6e8310a-394e-4d9e-b16a-6efc90e8ec2f" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%203.png

</div>
<span id="b139a343-d386-4c86-b640-119afe03a7c2"></span>
== Open SSL ==

Select “I accept the agreement” and click “Next”.

<div id="87c24674-c27d-44ef-b6f8-2caf2e5a6ee8" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%204.png

</div>
Click “Next”.

<div id="993d04fb-6e83-48cb-8435-9e549b73f80e" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%205.png

</div>
Click “Next”.

<div id="5f37c901-f2be-466e-9daf-d248359691eb" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%206.png

</div>
Select “The OpenSSL binaries (/bin) directory” and click “Next”.

<div id="3bdf9c12-90dc-42cc-91aa-09082a81faa5" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%207.png

</div>
Click “Install”.

<div id="1a8f5f89-5d5e-4754-8078-a9024a9f64c8" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%208.png

</div>
Click “Finish”.

<div id="f49fabc8-fb83-4bce-954c-e4328c52b147" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%209.png

</div>
The OpenSSL executable file is stored in this directory:

<pre class="code">C:\Program Files\OpenSSL-Win64\bin</pre>
<span id="dc8621b6-408a-4490-9cf5-7e5935e588b8"></span>

= STEP 2: Create the certificate config file =

I am using the information in the table below of the Pod-120-NSXT-LM (wildcard) as input for the config file.

<div id="f29e456d-bc32-4daf-be60-49638b666704" class="collection-content">

<span id="section"></span>
====  ====

{| class="wikitable collection-content"
|-
! NSX Manager Node
! C(ommon N(Name)
! O(rganization)
! O(rg) (Unit)
! C(ountry)
! ST(ate)
! L(ocality)
! (SAN) DNS Names
! Key Size
! Algorithm
|-
| Pod-120-NSXT-LM-1
| pod-120-nsxt-lm-1.sddc.lab
| NSX Academy
| Education
| NL
| ZH
| Rotterdam
| pod-120-nsxt-lm-1.sddc.lab
| 2048
| RSA
|-
| Pod-120-NSXT-LM-2
| pod-120-nsxt-lm-2.sddc.lab
| NSX Academy
| Education
| NL
| ZH
| Rotterdam
| pod-120-nsxt-lm-2.sddc.lab
| 2048
| RSA
|-
| Pod-120-NSXT-LM-3
| pod-120-nsxt-lm-3.sddc.lab
| NSX Academy
| Education
| NL
| ZH
| Rotterdam
| pod-120-nsxt-lm-3.sddc.lab
| 2048
| RSA
|-
| Pod-120-NSXT-LM
| pod-120-nsxt-lm.sddc.lab
| NSX Academy
| Education
| NL
| ZH
| Rotterdam
| pod-120-nsxt-lm.sddc.lab
| 2048
| RSA
|-
| Pod-120-NSXT-LM (wildcard)
| pod-120-nsxt-lm.sddc.lab
| NSX Academy
| Education
| NL
| ZH
| Rotterdam
| pod-120-nsxt-lm.sddc.lab<br />
pod-120-nsxt-lm-1.sddc.lab<br />
pod-120-nsxt-lm-2.sddc.lab<br />
pod-120-nsxt-lm-3.sddc.lab<br />
pod-120-nsxt-lm<br />
pod-120-nsxt-lm-1<br />
pod-120-nsxt-lm-2<br />
pod-120-nsxt-lm-3<br />

| 2048
| RSA
|}

</div>
Create a new file named <code>nsx.cfg </code>with the following content.

<pre class="code">[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
[ v3_req ]
basicConstraints = CA:TRUE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:pod-120-nsxt-lm, DNS:pod-120-nsxt-lm.sddc.local, DNS:pod-120-nsxt-lm-1, DNS:pod-120-nsxt-lm-1.sddc.local, DNS:pod-120-nsxt-lm-2, DNS:pod-120-nsxt-lm-2.sddc.local, DNS:pod-120-nsxt-lm-3, DNS:pod-120-nsxt-lm-3.sddc.local
[ req_distinguished_name ]
countryName = NL
stateOrProvinceName = ZH
localityName = Rotterdam
0.organizationName = NSX Academy
organizationalUnitName = Education
commonName = pod-120-nsxt-lm.sddc.local</pre>
Save the file in a separate <code>/certs</code> folder (to keep things clean).

<div id="ae7a8905-1d2e-4b25-b512-5b6b66348bdb" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%2010.png

</div>
<span id="d43011ff-6892-4bf1-b36c-4d9bd303c441"></span>
= STEP 3: Use OpenSSL to generate the .csr and .key file =

Use the following command to generate the .csr and .key file.

<pre class="code">C:\Program Files\OpenSSL-Win64\bin&gt;openssl req -out ./certs/nsxcert.csr -newkey rsa:2048 -nodes -keyout ./certs/nsxcert.key -config ./certs/nsx.cfg
Generating a RSA private key
..............+++++
...............+++++
writing new private key to './certs/nsxcert.key'
-----

C:\Program Files\OpenSSL-Win64\bin&gt;</pre>
Verify if the .csr and .key file are available.

<div id="8b27f5f4-2b6c-436c-bfca-1fda3d42213f" class="figure image">

https://www.iwanhoogendoorn.nl/images/thumb/blog/18/Untitled%2011.png

</div>
<div class="collapsible">
    <div class="collapsible-alone-header">The CSR output:</div>
   <div class="collapsible-content">
<pre class="code">-----BEGIN CERTIFICATE REQUEST-----
MIID4zCCAssCAQAwfTELMAkGA1UEBhMCTkwxCzAJBgNVBAgTAlpIMRIwEAYDVQQH
EwlSb3R0ZXJkYW0xFDASBgNVBAoTC05TWCBBY2FkZW15MRIwEAYDVQQLEwlFZHVj
YXRpb24xIzAhBgNVBAMTGnBvZC0xMjAtbnN4dC1sbS5zZGRjLmxvY2FsMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvDqoVcDu6hxqalmsKRwNETnVcIfp
rll5jo3PvkZH8c6j6yH5QldM0KuCa9N0Bo4M6VJ7hhNi7BQfWdLxLctR7PSS3eLc
3xvmL5Ed2WNtdgXqyLUA1LaIKQBT8X9FQZ3sal9OHJkDLWw7aJvnsuhNGIcykB+L
C9CVd99w+wGqNXSVbk1AFOKekCZuboQ+FmPxjZTH2a/Bct9FzvQRi5M1tA+4g+yu
sVoYe5zn89h2u6qtCVpHpd/0F3BmSIQsciSrtdQJ3+24RNhvETYNhyoXGfWVbObU
16nIIKd/UaNuG3JVKcyDxl7CdcxJHPjNoUU9js5Om7BN1Wqv6G1O+N6OFQIDAQAB
oIIBHzCCARsGCSqGSIb3DQEJDjGCAQwwggEIMAwGA1UdEwQFMAMBAf8wCwYDVR0P
BAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjCBywYDVR0RBIHD
MIHAgg9wb2QtMTIwLW5zeHQtbG2CGnBvZC0xMjAtbnN4dC1sbS5zZGRjLmxvY2Fs
ghFwb2QtMTIwLW5zeHQtbG0tMYIccG9kLTEyMC1uc3h0LWxtLTEuc2RkYy5sb2Nh
bIIRcG9kLTEyMC1uc3h0LWxtLTKCHHBvZC0xMjAtbnN4dC1sbS0yLnNkZGMubG9j
YWyCEXBvZC0xMjAtbnN4dC1sbS0zghxwb2QtMTIwLW5zeHQtbG0tMy5zZGRjLmxv
Y2FsMA0GCSqGSIb3DQEBCwUAA4IBAQA6fDcPpFJ1ozTMh0F9a7+JCen6s1n9gg3K
KOs9uqCBYYsNmRLmH33dM5GifTL7GRpu5vrjyiA7pFwFU7DjWS/NK+sRZAlb5FTV
wA678mLkhsXj1HW8HxB6+UuQ/2fBehZ7MkYLukFRYxcBuqupZkGrp/n7NnRj9l5p
1f2gUjfyR3Wn2J8Dp/iFDkJ8feUYIHvRKni44B6NPo6nysGXCOeFclBnQ61gja28
yhhEOzsUwXTmsBSByUzHII9VqyhTP2sdZq0nT7sLhcyy47Q2JtvQ2B7dp6M1kHG1
XvJg/OTrdJE9O+8IRQ3qDn9bSrgW6FUPUgJbL4wSO1u7h2uArcud
-----END CERTIFICATE REQUEST-----</pre></div></div>

<div class="collapsible">
    <div class="collapsible-alone-header">The Private Key output:</div>
   <div class="collapsible-content">
<pre class="code">-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8OqhVwO7qHGpq
WawpHA0ROdVwh+muWXmOjc++RkfxzqPrIflCV0zQq4Jr03QGjgzpUnuGE2LsFB9Z
0vEty1Hs9JLd4tzfG+YvkR3ZY212BerItQDUtogpAFPxf0VBnexqX04cmQMtbDto
m+ey6E0YhzKQH4sL0JV333D7Aao1dJVuTUAU4p6QJm5uhD4WY/GNlMfZr8Fy30XO
9BGLkzW0D7iD7K6xWhh7nOfz2Ha7qq0JWkel3/QXcGZIhCxyJKu11Anf7bhE2G8R
Ng2HKhcZ9ZVs5tTXqcggp39Ro24bclUpzIPGXsJ1zEkc+M2hRT2Ozk6bsE3Vaq/o
bU743o4VAgMBAAECggEAfwn34yi8FzXmfLDZCUXta9rku3Z/uTSaXiRIOdulYwZc
i636VVQmfA/FjpDAlkv5WuBYjj03Xq6WGkHMlWPMf2jyVt9uwwZJbYE77CS3FBka
RSwky2wGqeWWwj9rtsWncoOwbIy5IEcUMZ5H2u/+WLem4K7pYaf9uVINJtwQzNIg
obg7EfuHzfIQAS35kiGUKzwnPCrXBUrriNYkLlfUP7EdRTm6VWecW30cn6jNFeGz
pNhiQwWZQKSJZwPn7jx7iui2hvRjGF3kNRUmnBywBXmFYWnlu9o1TBAmM/FdbzYW
ycbme2XMtq1ndGPyRio+CcPwV5rQy1EWI/8U0/X2AQKBgQD0b3cYbu1qNmB+Zf4l
j4O6S3+xMWEAUnGtKObTpvmU3RgEHQhb+FNxLr0Rl07SX5SeowrAmMu/BkfDLMJB
wxWl/XOstxVOn3nJiAQMxll/D6ZWK/xtOzlPaEzRWXJWevKajEOQIAfLcRU9kdzo
UMwtyaEUPsu08moGBqctohlTsQKBgQDFIm/wrQD0ZmcT/Zu/uGZoK7eLqLZbudwF
KD3IZotx8HLWZY4Q+trvU8PHMX4KC4dknwGnZWBZJVvhgIZVQc7uV3Fw1uvkx6xc
LWsSM5OjL7ZMG71nn8X7w0vNwTwOx7Idyye3rR8IQ01ZmNc9FuTrWqwU1pnRek3u
nCcgcQ2tpQKBgDVFkbQegNmUDkWd3ty6wV+5kpPAij5yuVmev2fDTUOXR+OlnCvH
HBBfuk76JfCNaiuEpxRAeK8iJEOyHogMh0xMx4gNwrQG55j3bsKF+/1IIN1I6tO3
g4790TgTAWs9kmACT7s6b9hzxchMYNO0wDr+ZX+vC+BcsKStkIPOfyyRAoGAIpCW
Ngnvh+rImg22mFgZxJwds6QiTVT6SgEzTAcG3jR9vi/SSBHj/2CdjDiWU+aPl8n1
fUdeLGNLh++EHkDKqqm0X0ef1t5Xz1W7V1apxUwhV5jpjdjK2wj0KqB+Ck1jYqvz
S9ZUAZvjXRlabACupMGiOIkkMUGTlonUpnCMKG0CgYEAknpiKBTjh/agU99qRWI2
BX6ZEQnEdnX0o5Jb/Ceckjx/gC3H179jjhKztMySvc/Li12S6ViwptetLLgJTtQo
HUUV7UzA29zplTJxJUHqM+REk7xQONbUMUX8XjDejfqxR+yvJ1ojIxTx6Rv9qtKF
Fm6TSrqXD76hx7P+WrztcVc=
-----END PRIVATE KEY-----</pre></div></div>

'''Continue with >>''' [[Lab: Signing the NSX CSR with a Microsoft (root) CA Server]]

[[Category:NSX]]
[[Category:Networking]]
[[Category:VMware]]
[[Category:NSX Academy]]