In this lab I am working with the following software and versions:

Software	Version	Filename
VMware NSX	4.0.0.1	nsx-unified-appliance-4.0.0.1.0.20159694.ova
Windows Server	2019	en_windows_server_2019_updated_feb_2020_x64_dvd_de383770.iso
OpenSSL	1.1.1q	Win64OpenSSL_Light-1_1_1q.exe
Visual C++ Redistributable Packages 2017	14.16.27033	VC_redist.x64.exe

Create a “wildcard” CSR that can be used to sign and that can be used for all NSX Manager Nodes including the NSX Manager VIP address.

⚠️ You can not use the NSX Manager to generate a new CSR that are usable for the signing and replacement of CA signed certificates. The NSX Manager does not provides the private key with the CSR. This private key is required later in this step. For this reason you need to use another tool to generate the CSR. I am using OpenSSL in this article.

The Steps

STEP 1: Install OpenSSL and Visual C++ Redistributable Packages
STEP 2: Create a the certificate config file
STEP 3: Use OpenSSL to generate the .csr and .key file

STEP 1: Install OpenSSL and Visual C++ Redistributable Packages

Visual C++ Redistributable Packages

Agree on the license terms and conditions and click “Install”.

Review the progress.

Click on “

Open SSL

Select “I accept the agreement” and click “Next”.

Click “Next”.

Select “The OpenSSL binaries (/bin) directory” and click “Next”.

Click “Install”.

Click “Finish”.

The OpenSSL executable file is stored in this directory:

C:\Program Files\OpenSSL-Win64\bin

STEP 2: Create the certificate config file

I am using the information in the table below of the Pod-120-NSXT-LM (wildcard) as input for the config file.

NSX Manager Node	C(ommon N(Name)	O(rganization)	O(rg) (Unit)	C(ountry)	ST(ate)	L(ocality)	(SAN) DNS Names	Key Size	Algorithm
Pod-120-NSXT-LM-1	pod-120-nsxt-lm-1.sddc.lab	NSX Academy	Education	NL	ZH	Rotterdam	pod-120-nsxt-lm-1.sddc.lab	2048	RSA
Pod-120-NSXT-LM-2	pod-120-nsxt-lm-2.sddc.lab	NSX Academy	Education	NL	ZH	Rotterdam	pod-120-nsxt-lm-2.sddc.lab	2048	RSA
Pod-120-NSXT-LM-3	pod-120-nsxt-lm-3.sddc.lab	NSX Academy	Education	NL	ZH	Rotterdam	pod-120-nsxt-lm-3.sddc.lab	2048	RSA
Pod-120-NSXT-LM	pod-120-nsxt-lm.sddc.lab	NSX Academy	Education	NL	ZH	Rotterdam	pod-120-nsxt-lm.sddc.lab	2048	RSA
Pod-120-NSXT-LM (wildcard)	pod-120-nsxt-lm.sddc.lab	NSX Academy	Education	NL	ZH	Rotterdam	pod-120-nsxt-lm.sddc.lab pod-120-nsxt-lm-1.sddc.lab pod-120-nsxt-lm-2.sddc.lab pod-120-nsxt-lm-3.sddc.lab pod-120-nsxt-lm pod-120-nsxt-lm-1 pod-120-nsxt-lm-2 pod-120-nsxt-lm-3	2048	RSA

Create a new file named nsx.cfg with the following content.

[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
[ v3_req ]
basicConstraints = CA:TRUE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:pod-120-nsxt-lm, DNS:pod-120-nsxt-lm.sddc.local, DNS:pod-120-nsxt-lm-1, DNS:pod-120-nsxt-lm-1.sddc.local, DNS:pod-120-nsxt-lm-2, DNS:pod-120-nsxt-lm-2.sddc.local, DNS:pod-120-nsxt-lm-3, DNS:pod-120-nsxt-lm-3.sddc.local
[ req_distinguished_name ]
countryName = NL
stateOrProvinceName = ZH
localityName = Rotterdam
0.organizationName = NSX Academy
organizationalUnitName = Education
commonName = pod-120-nsxt-lm.sddc.local

Save the file in a separate /certs folder (to keep things clean).

STEP 3: Use OpenSSL to generate the .csr and .key file

Use the following command to generate the .csr and .key file.

C:\Program Files\OpenSSL-Win64\bin>openssl req -out ./certs/nsxcert.csr -newkey rsa:2048 -nodes -keyout ./certs/nsxcert.key -config ./certs/nsx.cfg
Generating a RSA private key
..............+++++
...............+++++
writing new private key to './certs/nsxcert.key'
-----

C:\Program Files\OpenSSL-Win64\bin>

Verify if the .csr and .key file are available.

The CSR output:

The Private Key output:

Continue with >> Lab: Signing the NSX CSR with a Microsoft (root) CA Server

Lab:Use OpenSSL to generate the Certificate Signing Request (CSR) for VMware NSX (with multiple SANs)

Contents