Update vCenter CA certificate references

This page describes how to update the reference to the vCenter CA certificate if it has changed, as your running admin cluster and user clusters must be informed of the change. This affects the vCenter.caCertPath field in the admin cluster configuration file and the user cluster configuration files for Google Distributed Cloud.

You can update the certificate references with the gkectl update command as described here.

Update the referenced vCenter CA certificate in the cluster configuration files

To update the running admin and user clusters to use the new certificate:

1. Retrieve the new vCenter CA certificate and extract it:

   curl -o certs.zip https:// VCENTER_IP_ADDRESS_OR_FQDN 
   /certs/download.zip
   unzip certs.zip

   You can use the -k flag if you want to allow unknown certificates. This is to avoid any certificate issues you may have accessing vCenter.

2. Determine which of the vCenter certificates is valid. Only one of the Linux certificate files in the extracted ..../certs/lin folder is the valid vCenter certificate. To determine which file is the valid vCenter certificate, do the following:

   1. Set the following environment variables from the Admin Workstation where govc is already installed. If not already done, download and install govc tool :

      export GOVC_URL=https:// VCENTER_IP_ADDRESS_OR_FQDN 
      export GOVC_USERNAME= VCENTER_USERNAME 
      export GOVC_PASSWORD= VCENTER_PASSWORD 
      export GOVC_TLS_CA_CERTS= FULL_PATH_OF_EXTRACTED_LIN_FILE 
      export GOVC_INSECURE=false