VMware Cloud Foundation APIs: Configure Certificate Authorities

calendar Jul 30, 2026 · 5 min read · VCF VCF 9.1 API Certificates  ·
Share on: linkedin copy

A key fleet management capability delivered by VMware Cloud Foundation is the ability to centrally manage certificates across all the components of your platform, the process involves first configuring VCF Operations to interact with either a Microsoft or an OpenSSL Certificate Authority. The process is very similar to the way in which this was done with SDDC Manager prior to the release of VMware Cloud Foundation 9.x, the main difference being that VCF Operations is now the endpoint you interact with and as a result there are some minor changes to the JSON payload.

In this blog we will walk through the process of configuring both a Microsoft Certificate Authority as well as the OpenSSL Certificate Authority which is still provided through the SDDC Manager appliance which we can utilize for the purpose of this post. It is however recommended for a production platform you install your own OpenSSL Certificate Authority if you plan to use this method.

VCF Operations APIs Used

VMware Cloud Foundation Operations API

  • POST /suite-api/api/auth/token/acquire
  • GET /suite-api/api/fleet-management/certificate-management/certificate-authorities
  • PUT /suite-api/api/fleet-management/certificate-management/certificate-authorities

Configure a Microsoft Certificate Authority

  1. Connect to a system that has access to your infrastructure and is capable of running CURL.

  2. Replace the values in the sample code with values for your VCF Operations instance and run the commands in the console.

1export vcfOperationsFqdn='flt-ops01a.rainpole.io'
2export vcfOperationsUser='admin'
3export vcfOperationsPass='VMw@re1!VMw@re1!'
  1. Authenticate to VCF Operations and obtain a token by running the following command:
1vcfOperationsToken=$(curl -k -X POST https://${vcfOperationsFqdn}/suite-api/api/auth/token/acquire \
2    --header "Content-Type:application/json" \
3    --header "Accept: application/json" \
4    -d "{\"username\":\"$vcfOperationsUser\", \"password\":\"$vcfOperationsPass\"}" \
5    | jq -r '.token')
  1. Verify you were able to successfully obtain an authentication token by running the following command:
1echo $vcfOperationsToken

Example Output:

16513db65-1c46-4482-9a4c-d257cd422906::bf144935-712c-4e2e-8881-8005575b47cd
  1. First lets check to see if a certificate authority has been configured by running the following command:
1curl -k -X GET "https://${vcfOperationsFqdn}/suite-api/api/fleet-management/certificate-management/certificate-authorities" \
2  --header "Authorization: OpsToken ${vcfOperationsToken}" \
3  --header "Content-Type:application/json" \
4  --header "Accept: application/json" \
5  | jq

Example Output:

1{
2  "microsoftCertificateAuthoritySpec": {},
3  "openSSLCertificateAuthoritySpec": {}
4}
  1. Replace the values in the sample code with your values and run the commands in the console.
1export certificateAuthorityUrl='https://arkham-dc01.arkham.io/certsrv'
2export certificateAuthorityUser='svc-vcf-ca'
3export certificateAuthorityPass='VMw@re1!'
4export certificateAuthorityTemplate='VMware'
  1. Create the JSON payload by running the following command:
 1cat << EOF > certificate-authority.json
 2{
 3  "certificateAuthorityType": "MICROSOFT",
 4  "certificateAuthoritiesSpec": {
 5    "microsoftCertificateAuthoritySpec": {
 6      "serverUrl": "${certificateAuthorityUrl}",
 7      "username": "${certificateAuthorityUser}",
 8      "secret": "${certificateAuthorityPass}",
 9      "templateName": "${certificateAuthorityTemplate}"
10    }
11  }
12}
13EOF
  1. Verify the JSON payload has been populated correctly by running the following command:
1cat certificate-authority.json

Example Output:

 1{
 2  "certificateAuthorityType": "MICROSOFT",
 3  "certificateAuthoritiesSpec": {
 4    "microsoftCertificateAuthoritySpec": {
 5      "serverUrl": "https://arkham-dc01.arkham.io/certsrv",
 6      "username": "svc-vcf-ca",
 7      "secret": "VMw@re1!",
 8      "templateName": "VMware"
 9    }
10  }
11}
  1. Configure a Microsoft Certificate Authority in VCF Operations by running the following command:
1curl -ks -X PUT "https://${vcfOperationsFqdn}/suite-api/api/fleet-management/certificate-management/certificate-authorities" \
2  --header "Authorization: OpsToken ${vcfOperationsToken}" \
3  --header "Content-Type:application/json" \
4  --header "Accept: application/json" \
5  -d @certificate-authority.json
  1. Verify the certificate authority has been configured by running the following command:
1curl -k -X GET "https://${vcfOperationsFqdn}/suite-api/api/fleet-management/certificate-management/certificate-authorities" \
2  --header "Authorization: OpsToken ${vcfOperationsToken}" \
3  --header "Content-Type:application/json" \
4  --header "Accept: application/json" \
5  | jq

Example Output:

1{
2  "microsoftCertificateAuthoritySpec": {
3    "serverUrl": "https://arkham-dc01.arkham.io/certsrv",
4    "username": "svc-vcf-ca",
5    "secret": "XXXXX",
6    "templateName": "VMware"
7  },
8  "openSSLCertificateAuthoritySpec": {}
9}

Configure an OpenSSL Certificate Authority

  1. Connect to a system that has access to your infrastructure and is capable of running CURL.

  2. Replace the values in the sample code with values for your VCF Operations instance and run the commands in the console.

1export vcfOperationsFqdn='flt-ops01a.rainpole.io'
2export vcfOperationsUser='admin'
3export vcfOperationsPass='VMw@re1!VMw@re1!'
  1. Authenticate to VCF Operations and obtain a token by running the following command:
1vcfOperationsToken=$(curl -k -X POST https://${vcfOperationsFqdn}/suite-api/api/auth/token/acquire \
2    --header "Content-Type:application/json" \
3    --header "Accept: application/json" \
4    -d "{\"username\":\"$vcfOperationsUser\", \"password\":\"$vcfOperationsPass\"}" \
5    | jq -r '.token')
  1. Verify you were able to successfully obtain an authentication token by running the following command:
1echo $vcfOperationsToken

Example Output:

16513db65-1c46-4482-9a4c-d257cd422906::bf144935-712c-4e2e-8881-8005575b47cd
  1. First lets check to see if a certificate authority has been configured by running the following command:
1curl -k -X GET "https://${vcfOperationsFqdn}/suite-api/api/fleet-management/certificate-management/certificate-authorities" \
2  --header "Authorization: OpsToken ${vcfOperationsToken}" \
3  --header "Content-Type:application/json" \
4  --header "Accept: application/json" \
5  | jq

Example Output:

1{
2  "microsoftCertificateAuthoritySpec": {},
3  "openSSLCertificateAuthoritySpec": {}
4}
  1. Replace the values in the sample code with your values and run the commands in the console.
1export openSslCommonName='sfo-vcf01.sfo.rainpole.io'
2export openSslOrganization='Rainpole'
3export openSslOrganizationUnit='IT'
4export openSslLocality='San Francisco'
5export openSslState='California'
6export openSslCountry='US'
  1. Create the JSON payload by running the following command:
 1cat << EOF > certificate-authority.json
 2{
 3  "certificateAuthorityType": "OPENSSL",
 4  "certificateAuthoritiesSpec": {
 5    "openSSLCertificateAuthoritySpec": {
 6      "commonName": "${openSslCommonName}",
 7      "organization": "${openSslOrganization}",
 8      "organizationUnit": "${openSslOrganizationUnit}",
 9      "locality": "${openSslLocality}",
10      "state": "${openSslState}",
11      "country": "${openSslCountry}"
12    }
13  }
14}
15EOF
  1. Verify the JSON payload has been populated correctly by running the following command:
1cat certificate-authority.json

Example Output:

 1{
 2  "certificateAuthorityType": "OPENSSL",
 3  "certificateAuthoritiesSpec": {
 4    "openSSLCertificateAuthoritySpec": {
 5      "commonName": "sfo-vcf01.sfo.rainpole.io",
 6      "organization": "Rainpole",
 7      "organizationUnit": "IT",
 8      "locality": "San Francisco",
 9      "state": "California",
10      "country": "US"
11    }
12  }
13}
  1. Configure an OpenSSL Certificate Authority in VCF Operations by running the following command:
1curl -ks -X PUT "https://${vcfOperationsFqdn}/suite-api/api/fleet-management/certificate-management/certificate-authorities" \
2  --header "Authorization: OpsToken ${vcfOperationsToken}" \
3  --header "Content-Type:application/json" \
4  --header "Accept: application/json" \
5  -d @certificate-authority.json
  1. Verify the certificate authority has been configured by running the following command:
1curl -k -X GET "https://${vcfOperationsFqdn}/suite-api/api/fleet-management/certificate-management/certificate-authorities" \
2  --header "Authorization: OpsToken ${vcfOperationsToken}" \
3  --header "Content-Type:application/json" \
4  --header "Accept: application/json" \
5  | jq

Example Output:

 1{
 2  "microsoftCertificateAuthoritySpec": {
 3    "serverUrl": "https://arkham-dc01.arkham.io/certsrv",
 4    "username": "svc-vcf-ca",
 5    "secret": "XXXXX",
 6    "templateName": "VMware"
 7  },
 8  "openSSLCertificateAuthoritySpec": {
 9    "commonName": "sfo-vcf01.sfo.rainpole.io",
10    "country": "US",
11    "locality": "San Francisco",
12    "organization": "Rainpole",
13    "organizationUnit": "IT",
14    "state": "California"
15  }
16}

Posts in this Series