Here’s a powershell script to generate a Let’s Encrypt certificate and upload that certificate to your Nutanix cluster and/or Prism Central.
I want my clusters to be available via:
- cluster-a.tielenconsultancy.nl
- cluster-b.tielenconsultancy.nl
- cluster-c.tielenconsultancy.nl
- tielanix.tielenconsultancy.nl (This is Prism Central)
The tielenconsultancy.nl domain is avaiable on the internet and internal. The clusters aren’t available via the internet offcourse 😉
So this will only work if you have a public domain where you can add a cname record pointing to a code Let’s Encrypt will provide. On the internal DNS server you can make the a records pointing to clusters virtual ip’s.
Read the comments in the script, they will explain everything. (Renewing will be added later when my certificates expire :P)
NOTE 1: Only for the community edition 😉 Dont use it on you production clusters.
NOTE 2: I’m using a wildcard certificate. This is not recommended anymore ;).
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 |
<# This script will generate a Let's Encrypt certificate and will bind it to your Nutanix clusters and, if needed, to Prism Central. THIS WILL ONLY WORK ON POWERSHELL 7. Version : 1.0 Date : 5 May 2023 Created by : Jeroen Tielen - Tielen Consultancy B.V. Email : jeroen@tielenconsultancy.nl History : 1.0 : 5 May 20023 - Initial setup script. #> # Stop script is PowerShell 7 isn't used. If ($PSVersionTable.PSVersion.Major -lt 7) { Write-Host "PowerShell version 7 or higher is required." Exit } # Install posh-acme if not installed yet. If (Get-Module -ListAvailable -Name Posh-ACME) { Write-Host "Module exists, skipping module installation." } Else { Write-Host "Module does not exist, installing." Install-Module -name posh-acme -AcceptLicense } # This command will generate a new wilcard certificate. It this is the first time you run it, it will show you a cname record which is needed on your public DNS server. # Change is to your own dns name. # The check, after created the cname, can take up to two (2) minutes. Please be patient. New-PACertificate *.tielenconsultancy.nl -accepttos -contact jeroen@tielenconsultancy.nl -dnsplugin AcmeDns -PluginArgs @{ACMEServer='auth.acme-dns.io'} -Install # Let list the required certificate and fill the variable with it. Get-PACertificate | Format-List $Certificatefiles = Get-PACertificate # Ask for your Nutanix credentials and contruct the authorization header. $Credentials = Get-Credential -Message "Enter your Nutanix credentials" -UserName "admin" $UserName = $Credentials.UserName $Password = $Credentials.GetNetworkCredential().Password $AuthHeader = @{ Authorization = "Basic " + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($UserName + ":" + $Password)) } # Generate the payload to upload via API to the cluster. $Form = @{ keyType = "RSA_2048" key = Get-Item -Path $Certificatefiles.KeyFile cert = Get-Item -Path $Certificatefiles.CertFile caChain = Get-Item -Path $Certificatefiles.ChainFile } # Assign the certificate to the clusters. Change to IP-Address to your cluster(s) ipadresses, remove the last 2 lines if you only have 1 cluster ;) Invoke-RestMethod -Method Post -Uri "https://192.168.2.72:9440/PrismGateway/services/rest/v1/keys/pem/import" -Form $Form -Headers $AuthHeader -SkipCertificateCheck Invoke-RestMethod -Method Post -Uri "https://192.168.2.74:9440/PrismGateway/services/rest/v1/keys/pem/import" -Form $Form -Headers $AuthHeader -SkipCertificateCheck Invoke-RestMethod -Method Post -Uri "https://192.168.2.76:9440/PrismGateway/services/rest/v1/keys/pem/import" -Form $Form -Headers $AuthHeader -SkipCertificateCheck # Assign the certificate to Prism Central. Change to IP-Address to your Prism Central virtual ip. Invoke-RestMethod -Method Post -Uri "https://192.168.2.70:9440/PrismGateway/services/rest/v1/keys/pem/import" -Form $Form -Headers $AuthHeader -SkipCertificateCheck |
1 Comment
Replace Nutanix SSL certificate with Let’s Encrypt certificate — Tielen Consultancy | Farhan Parkar's Weblog · May 5, 2023 at 17:46
[…] Replace Nutanix SSL certificate with Let’s Encrypt certificate — Tielen Consultancy […]