How to import your VCSA certificate so ALL VMware vSphere browser security warnings go away in Windows 10
You can free up tons of vertical real-estate when doing your day-to-day vSphere sysadmin by hiding the URLs and tabs and dead space in Chrome, see:
The thing is, home-lab friendly browser features such as (insecure) password saving don't work once Chrome, or other browsers, have that intentionally nasty red X certificate warning mode, prompting you to bypass before even showing you the suspect page. Won't you feel better getting rid of those warnings, once and for all? Yes, this method even works for the vSphere Web Client (Flash) and the VMware Host Client/vSphere Client (HTML5), and leverages the certificate authority baked right into VCSA! Now you know why FQDN and DNS is so important for VCSA, eh?
It's easy, just one certificate to import into your Windows 10 system-wide "Trusted Root Certification Authorities" store. Video details the simple procedure below.
Prerequisites
These are the circumstances in my home lab, where I recorded this short video:
- willingness to type in FQDN
eg. https://vcsa.lab.local, not just https://vcsa
(I create single-click taskbar shortcuts anyway) - stand-alone Windows in workgroup mode
(not joined to Active Directory) - Administrative rights to Windows
- VCSA 6.0 or later
If you meet these prerequisites, great, this video will show you exactly how easy this is!
If not, or if you use Firefox, read VMware KB 2108294 for guidance, see also comment below.
Video
Step-by-step, with explanations as I go:
Instructions - visual
What I like about this is that it's a do it once thing, and you'll likely never forget it. Nice that the certificate doesn't expire for 10 years too ;)
If you get this error when attempting to log in to your VCSA appliance from chrome:
Your connection is not private
Attackers might be trying to steal your information from vcsa.lab.local (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_AUTHORITY_INVALID
it's easiest to cut over to Firefox, and follow the rest of the below steps from there.
Now test it.
- close Edge Browser
- close Chrome
- open Chrome
- if Chrome still shows certificate warnings, close it again, and use Task Manager's 'Processes' Tab to to kill all chrome.exe instances, then open Chrome again to retest
- if you're looking to fix Firefox, see VMware's guidance here.
- that's it, enjoy the happy green padlock for the next 10 years!
Jan 31 2020 Update
Great info in this @lamw tweet, here's an excerpt:
PSA: If you’ve upgraded to latest version of Chrome & having issues logging into vSphere Client w/ "NET::ERR_CERT_REVOKED”, you need “ghost type” on that page “thisisunsafe” to bypass
And here's the Google Support comment he refers to:
Abhaas Sood 12/6/19
This solution really works."Here's the fix!!! As of 10/21/19 the bypass word is "thisisunsafe"
Once you get to the page that says "Your connection is not private" click somewhere on the page and then blindly type the following thisisunsafe
This will instantly bypass the warning. Please don't do this on sites you don't trust."
I am just surprised how do people even find these kind of solutions.
See also at TinkerTry
See also
All Comments on This Article (13)
Following up and closing the loop, I added the .crt extension to the files mentioned above and was able to install the cert, no idea why it omitted the extension but it works.
If I download and change the extension to .zip I open it and see the certs folder, but then the certs inside of there are just .0 and .r0 which I've never seen before.
It says this app cannot run on this pc, location was a little diff for me as well, I downloaded the cert fine with Win7, never had any issues, so bizarre
c:\windows\system32\en-US\certmgr.msc
It's a long-shot, but what if you tell the dialogue box you're getting that you want to open it with
c:\windows\system32\certmgr.msc
?
Yeah it is strange, I don't get why/what is happening myself, definitely one of those frustrating issues. I have tried another win10 pc and the same thing happens, it just has a download file and doesn't download the certs as you'd expect.
Sorry, wow, strange, well, maybe try using another system’s browser to get the file downloaded, then copy it over to the system you want to import the cert to?
Browser makes no difference, already tried that before posting here.
Try a different browser as a work-around? It would seem you're not getting the download prompt, and instead it's opening it up right away instead.
When I try this on Win10 I don't get it to download it keeps asking me what to use to open the file? I've looked in all settings and just can't figure it out.
thumbs up!
Excellent, thank you, great feedback for everybody's benefit, very much appreciated!
Nice tutorial as always... If I can make two points. FireFox has its own certificate store (Chrome shares the Windows store) and will require a separate import. Not a big deal. For AD Domain joined devices you can still import on each member device as desired or distribute via GPO taking care to target accordingly (OU and/or WMI filter). Keep up the good work.
Paul Braren | TinkerTry.com
I really appreciate your following up with posting the resolution (workaround), it will be very likely to help others. Thank you!