3 main steps for setting up this.
1. Let's Encrypt certificate generation with DNS challenge.
Default challenge process with let's encrypt is HTTP-01 / acme-challenge file generation.
It's not convenient with ESXi use.
I switch to DNS-01 Challenge which is compliant with my DNS provider.
I use certbot tool.
You can install it with
apt install python3-pip
pip install certbot
I found a dedicated python certbot tool extension for challenge automation.
See OVH specific extension and complete tutorial
Specific tool is pip install certbot-dns-ovh
The final command is certbot itself :
certbot certonly -d mydomain.com
Specific version for OVH is certbot certonly -d mydomain.com --dns-ovh --dns-ovh-credentials ~/.ovh-api
You'll have to create .ovh-api file with these instructions
Thanks to his, I've got quickly a list of .pem files
2. Certificate format transform
Certificate are directly generated in .pem format so you do not need to change format. You just have to rename files
cp fullchain.pem rui.crt
cp privkey.pem rui.key
Be carefull, do not use cert.pem but fullchain.pem.
cert.pem is not compliant with ESXi
3. Renew certificate on VMWare esxi
On ESXi host, backup your old certificate
cd /etc/vmware/ssl/
mv rui.crt rui.crt.`date +%Y%m%d-%H%M%S`.bak
mv rui.key rui.key.`date +%Y%m%d-%H%M%S`.bak
Actually, you should backup these 2 files on your workstation.
scp myhost:/etc/vmware/ssl/*.bak ./
If ssl certificates are not compliant with vmware host client requirements, web ui will not start again... particulary boring and stressfull to fix ...
If you need to rollback and reset ssl, you can use /sbin/generate-certificates && reboot command
From your workstation:
Replace your certificate
scp rui.key rui.crt myhost:/etc/vmware/ssl/
On ESXi host, restart the host
reboot
