Something I noticed when deploying VCF 9.1 for a customer was that the VCF installer (SDDC Manager) is that during the installation I encountered an error (see below) complaining about an ssl error and was unable to download the packages for VCF installer. This led me to try from the CLI to see what actually happened.
* OpenSSL verify result: 13 * SSL certificate verification failed, continuing anyway! * Established connection ...
Additionally, you also need to have addresses whitelisted for a better download experience:
Public URL list for VCF Products
To fix the certificate issue, below is a way to do this:
1: What I did with this was first of all from the CLI of the vcf installer, obtain the certs installed on an already installed application. In my case I used the vCenter by running the follow command:
openssl s_client -connect aocvc01.aocit.net:443 -showcerts
It will return a few certificates, including the root certificate (the one that usually is the longest lasting thing int he list.
2: Copy the data between
------ BEGIN CERTIFICATE ------ ------ END CERTIFICATE ------
The data between the files should be entered in a new file f.x. aocit.crt
3: You can verify the output by entering the following:
openssl x509 -in aocit.crt -text -noout
You will get an output that should show when the cert works and when it expires along with various other information.
4: Next we need to get the pass key, we get this by running the following command:
KEY=$(cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key) | echo $KEY
This will show you the key and at thesame time read the key into a variable called KEY
5: Next we need to import the certificate we created above into the certificate store:
keytool -importcert -alias root_aocit -file aocit.crt -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store --storepass $KEY
6: Check that the certificate is ok and then run the following line:
keytool -importcert -alias aocit.crt -file aocit.crt -keystore /etc/alternatives/jre/lib/security/cacerts --storepass changeit
7: Finally restart the services:
/opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
8: After this you should have the proper certificates inside the certificate store and you can check the connection with the following command. Note you have to enter the key for the software download.
curl -vi telnet:dl.broadcom.com:443
If you use a proxy server you need something like the following:
curl -vix "https://proxyserverfqdn:port" "https://dl.broadcom"
You should get an output that shows that the ssl cert is trusted.