Rotating Non-Configurable Leaf Certificates

Page last updated:

This topic describes how to rotate non-configurable leaf certificates for your Ops Manager deployment. To rotate all certificates in your Ops Manager deployment, see Rotating CAs and Leaf Certificates.

Overview

This procedure rotates non-configurable leaf certificates visible to the Ops Manager API, whether they are managed and stored by Ops Manager directly, or by CredHub at Ops Manager request.

Warning: This procedure does not rotate the Ops Manager root certificate authority (CA) or other CAs in your deployment. To rotate CAs and leaf certificates, see Rotating CAs and Leaf Certificates.

Prerequisites

Before you rotate certificates:

  • You must reset any certificates that were manually set in CredHub on Ops Manager v2.6 and earlier to prevent them from being rotated with other certificates generated by CredHub. To find and reset any manually set certificates in CredHub, see Reviewing Manually Set Certificates in CredHub.

  • You must have both Ops Manager v2.9 and VMware Tanzu Application Service for VMs (TAS for VMs) v2.9 or later to rotate CredHub-managed certificates with this procedure. If you have a version of TAS for VMs earlier than v2.9, you can follow this procedure to rotate certificates managed by Ops Manager. Then, to rotate certificates managed in CredHub, see Advanced Certificate Rotation with CredHub Maestro.

  • You cannot have VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) installed to rotate CredHub-managed certificates with this procedure. If you have TKGI, you can follow this procedure to rotate certificates managed by Ops Manager. Then, to rotate certificates managed in CredHub, see Advanced Certificate Rotation with CredHub Maestro.

Procedure

To rotate non-configurable leaf certificates:

  1. Call the Ops Manager API regenerate endpoint by running:

    curl "https://OPS-MANAGER-FQDN/api/v0/certificate_authorities/active/regenerate" \
          -X POST \
          -H "Authorization: Bearer UAA-ACCESS-TOKEN" \
          -H "Content-Type: application/json" \
          -d '{}'
          -i
    

    Where:

    • OPS-MANAGER-FQDN is the fully-qualified domain name (FQDN) of your Ops Manager deployment.
    • UAA-ACCESS-TOKEN is your UAA access token.

      The API returns a successful response:
      HTTP/1.1 200 OK
  2. Navigate to the Ops Manager Installation Dashboard.

  3. If you have any on-demand service tiles installed, for each on-demand service tile:

    1. Click the tile.
    2. Click the Errands tab.
    3. Enable the Upgrade All Service Instances errand. Running this errand is necessary to push CredHub certificate updates to each service instance.
    4. Click Review Pending Changes.
    5. Click Apply Changes.
  4. If you do not have any on-demand service tiles installed:

    1. Click Review Pending Changes.
    2. Click Apply Changes.