In the previous article, we deployed an external PSC appliance and replaced it’s default root CA cert with a cert from an existing enterprise CA, such that every time VMCA assigns a cert to either vCenter or in turn, ESXi servers, it will have the full enterprise CA certificate chain rather than just vSphere’s cert chain.
Note the below design notes related to the vCenter server deployment illustrated here
- Similar to PSC, vCenter server will also be deployed using the VMware appliance (VCSA)
- A single vCenter instance is often sufficient with most requirements given that VMware HA will protect it from hardware failures.
Lets now quickly look at a typical deployment of the vCenter server (appliance)
Note: Deployment of vCenter server using the VCSA is somewhat identical to the earlier illustrated deployement of PSC, in that its the same appliance being deployed, and instead of selecting PSC mode, we are selecting the vCenter Server mode this time.
- Download the VMware vCSA appliance ISO from VMware and mount the ISO image on you workstation / jump host and launch the vcsa-setup.html file found on the root of the ISO drive.
- Now click install.
- Accept EULA and click next
- You can deploy the appliance directly to an ESXi host or deploy through a vCenter. Provide your target server details here with credentials.
- Type the appliance’s VM name & root password for the appliance’s Linux OS. Make a note as you’d need this later.
- Select the appropriate deployment type. We are deploying an external vCenter server here for an external PSC.
- We are now connecting the vCenter VCSA to the previously deployed PSC instance and the SSO details we configured.
- Select the appropriate vCenter server VCSA appliance size, based on the intended workload of the vCenter.
- Select the destination datastore to deploy the vCSA appliance on to
- Now select the vCenter database type. I’m using PostgreSQL here (built-in) as this will now likely be the preferred choice for many enterprise customers as its decent enough to scale up to 10,000 VMs and you don’t have to pay for an SQL server license. Those handful of customers who have an existing Oracle DB server can use Oracle here too.
- Now provide the IP & DNS details. Ensue you provide a valid NTP server and check that the time syncs properly from this source.
- Verify the settings and proceed to start deploying the appliance.
- Deployment progress and completion
SSL Certificate verifications & Updates (Important)!!
We’ve already updated the PSC’s default root certificate with a Enterprise CA signed root certificate in a previous step (Section “Optional – Replace the VMCA root certificate as explained here). So when you add the vCenter appliance to the PSC (which we’ve already performed earlier in this article, all the relevant certificates are supposed to be automatically created and allocated by the VMCA on to the vCenter. However I’ve seen issues with this so just to be on the safe side, I recommend we follow the rest of the steps involved in the KB article 2111219, under section “Replacing VMCA of the Platform Services Controller with a Subordinate Certificate Authority Certificate” as follows
- Replacing the vSphere 6.0 Machine SSL certificate with a VMware Certificate Authority issued certificate (2112279) – On the vCenter Server Appliance
- Replacing the vSphere 6.0 Solution User certificates with VMware Certificate Authority issued certificates (2112281) – On the vCenter Server Appliance
- If you use Auto Deploy, may want to consider applying the fix mentioned in the KB article 2123631. Otherwise, go the next task
- Follow the VMware KB 2109074 and
- Follow the listed “Task 0 – Validating the sslTrust Anchors for the PSC and vCenter” – This need to be tested on both the PSC appliance as well as the vCenter appliance as instructed.
- If the certificated don’t match, also follow the rest of the tasks as indicated
- Validating this here can save you lots of headache down the line…!!
That’s pretty much it for the deployment of the VCSA appliance in vCenter mode rather than the PSC mode.
Adding ESXi Servers to the vCenter server
Important note: If you decide to add the ESXi nodes to the vCenter straight away, please we aware of the fact that if the Enterprise subordinate certificate that replaced the VMCA root certificate has been valid for less than 24 hours, you CANNOT add any ESXi hosts as this is by design. See the KB2123386 for more information. In most enterprise deployments where the Enterprise subordinate certificate would have been likely issued few days in advance of the actual PSC & VCSA deployment, this would be a non issue but if you are one of those where you’ve obtained the cert from your Enterprise CA less than 24 hours ago, you need to wait before you can add ESXi servers to the vCenter server.
That’s it. Now its the time to configure your vCenter server for AD authentication via the PSC and all other post install config tasks as required.