The NSX-T Manager must obtain its public key certificates from an approved DoD certificate authority.

An XCCDF Rule

Description

For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For Federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority will suffice.

ID: SV-251792r879887_rule
Version: TNDM-3X-000095
Severity: Medium
References: CCI-000366 CCI-001159
Updated: 11 days ago

Remediation Templates

Obtain a certificate or certificates signed by an approved DoD certification authority. This can be done individually by generating CSRs through the NSX-T Manager web interface >> System >> Certificates >> CSRs >> Generate CSR or outside of NSX-T if a common manager and cluster certificate is desired.

Import the certificate(s) into NSX-T by doing the following:

From the NSX-T Manager web interface, go to System >> Certificates >> Import >> Import Certificate. Provide a name for the certificate and paste the certificates contents and key. Uncheck "Service Certificate" and click "Import".
After import note the ID of the certificate(s).

Using curl or another REST API client perform the following API calls and replace the certificate IDs noted in the previous steps.

To replace a managers certificate: POST https://<nsx-mgr>/api/v1/node/services/http?action=apply_certificate&certificate_id=e61c7537-3090-4149-b2b6-19915c20504f

To replace the cluster certificate: POST https://<nsx-mgr>/api/v1/cluster/api-certificate?action=set_cluster_certificate&certificate_id=d60c6a07-6e59-4873-8edb-339bf75711ac

Note: If an NSX Intelligence appliance is deployed with the NSX Manager cluster, update the NSX Manager node IP, certificate, and thumbprint information that is on the NSX Intelligence appliance. See VMware Knowledge Base article https://kb.vmware.com/s/article/78505 for more information.

The NSX-T Manager must obtain its public key certificates from an approved DoD certificate authority.

Description

Remediation Templates

A Manual Procedure