Replace the SSL Certificate on Nutanix Prism
Replace the SSL certificate on Nutanix Prism Element or Prism Central: supported key types, Replace Certificate in the UI or ncli ssl-certificate import, chain file and verification.
Prism Element (per cluster) and Prism Central present their web console and API with a cluster certificate. Replacing it is a Prism certificate-management operation - not a file copy onto individual Controller VMs (CVMs).
Before you begin
- Decide which endpoint you are changing: each Prism Element cluster and Prism Central have their own certificate. Changing one does not change the others.
- The SAN must contain the name administrators and API clients use - typically the cluster virtual IP's DNS name - and the virtual IP itself if clients connect by IP.
- Use a supported key type. Nutanix's security guide lists RSA 2048 with SHA-256, and ECDSA P-256 and P-384; check the guide for your AOS / Prism Central version.
- Prepare three PEM files:
- the server certificate,
- the matching private key, unencrypted,
- the CA chain: all intermediate certificates and the root CA in one file, root last.
- Keep the files of the current certificate and key - Prism does not give you the old private key back, and those files are your rollback.
- Note integrations that pin the old certificate (backup, monitoring, automation) - they need the new certificate or its CA afterwards - and check that the cluster is healthy in the Prism dashboard.
Step-by-step certificate replacement
In the web console
- Sign in to Prism as a cluster administrator.
- Open the gear icon (settings) and select SSL Certificate, then click Replace Certificate.
- Choose to import a key and certificate, select the key type that matches your key, and upload the private key, the server certificate and the CA chain file.
- Confirm. Prism restarts its web services to load the certificate: the console is unavailable for a few moments and you have to sign in again. Running virtual machines and cluster workloads are not affected.
With ncli
ncli commands apply to the whole cluster, so run it on one CVM of the Prism
Element cluster - or on the Prism Central VM for Prism Central - as the nutanix user,
with the files copied there (for example with scp):
ncli ssl-certificate import \
certificate-path=/home/nutanix/certs/server.pem \
key-path=/home/nutanix/certs/server.key \
cacertificate-path=/home/nutanix/certs/chain.pem \
key-type=RSA_2048Set key-type to match your key: RSA_2048, ECDSA_256 or ECDSA_384. The syntax
follows Nutanix's published examples; ncli's built-in help on your cluster shows the
exact options of your version.
Repeat for every Prism Element cluster and for Prism Central that should present the new certificate. The order does not matter; each is independent.
Verify the new certificate
openssl s_client -connect prism.example.com:9440 -servername prism.example.com -showcerts </dev/nullPrism listens on port 9440. Check subject and SAN, issuer, expiry date and the chain, sign in to the console by FQDN, and test the integrations that talk to Prism's API.
Rollback
Import the saved old certificate, key and chain with the same operation. If Prism does not come back, follow Nutanix's supported recovery procedure rather than editing files on CVMs.
Common problems
- The FQDN or virtual IP is missing from the SAN.
- The private key is encrypted, or does not match the certificate.
- The selected key type does not match the key, or the key type is not supported.
- The chain file is incomplete or has the root in the wrong place.
- Prism Central was changed, and the Prism Element clusters were assumed to inherit it.
Automating certificate replacement with aethercert
The aethercert Nutanix Prism target imports the certificate, CA chain, and private key through Prism's certificate-management API and derives the key type from the issued key.
See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.