With Purity //FA 5.3.0 and higher, the management of the VASA certificate is done with purecert in the CLI or API. What does this mean? It means that the end user does not require support or a support case to reset, update, or import certificate to the VASA Provider. Now let's cover what to do in the event that the FlashArray controller's IP is changed.
First you need to know what kind of certificate you have on the FlashArray. Is it the default certificate, is it the default VMCA Certificate, is it an imported self-signed certificate or is it an imported signed certificated? In the event that you are using a imported self-signed certificated or imported signed certificate, you will need to generate a new certificate and import it again.
Process if the VASA Certificate is an Imported Cert
Please follow this Generating and Importing the Certificate.
Here is a brief summary of the steps to follow:
- Remove the current storage provider in the vCenter(s) for the controller you will be changing the IP
- Change the IP Address for the controller
- Follow the KB linked above to generate a new certificate
- Import the updated certificate
- Re-register the storage provider for that controller in the vCenter(s)
In some cases the vCenter's certificate service may not refresh the changes in storage provider certificates. While vCenter is able to register the storage providers and they show active and online, ESXi hosts are unable to successfully establish connections to the VASA providers. In these cases the ESXi hosts need to have their CA/CRL information refreshed to them. Please see this KB Section for information on how to address this.
Process if the VASA Certificate is a VMCA Certificate
In the event that the default VMCA Certificate is in use, follow this Resetting the VASA Certificates with purecert with the updated IP.
Here is a brief summary of the steps to follow:
- Remove the current storage provider in the vCenter(s) for the Controller you will be changing the IP
- Change the IP Address for the Controller
- Follow the KB linked above to reset and create a new VASA certificate
- Re-register the storage provider for that Controller in the vCenter(s)
- Sometimes you may need to wait 15 minutes after resetting the certificate before registering the storage provider
In some cases the vCenter's certificate service may not refresh the changes in storage provider certificates. While vCenter is able to register the storage providers and they show active and online, ESXi hosts are unable to successfully establish connections to the VASA providers. In these cases the ESXi hosts need to have their CA/CRL information refreshed to them. Please see this KB Section for information on how to address this.