XenServer / Citrix Hypervisor / XCP-ng

Storage and virtualisation

Renews one hypervisor host’s management certificate through XAPI with TLS checks.

What happens

The appliance connects to XenServer / Citrix Hypervisor / XCP-ng through XAPI XML-RPC on port 443.
Select one XenServer, Citrix Hypervisor or XCP-ng host through the pool coordinator. The agent checks the PEM certificate and matching RSA key; HA must be disabled.
XAPI installs certificate, PKCS#8 key and ordered intermediates. The installed leaf is read back and the host’s TLS listener awaited for up to 90 seconds.

Connection: The package runs on the appliance, which connects over HTTPS to XAPI XML-RPC, port 443. No agent is installed.
Service ports: 443
You need: Use the pool's root account, or an Active Directory account with the Pool Admin role. Add the standalone host or the pool coordinator as the target (port 443). For a pool member, add the coordinator and enter the member's name or UUID in XAPI_HOST. High availability must be off while the certificate is installed.
Platform: XenServer / Citrix Hypervisor 8.2+, XCP-ng 8.2+
Actions: Discovery, Installation, Verification, Rollback
Packages: xapi-hypervisor 1.0.0
Note: Automatic restoration and rollback need previous certificate, key and optional chain; XAPI returns no private key. DEPLOYED_SHA256 can guard against later changes. No reset to a new self-signed identity is performed. XenServer/Citrix Hypervisor and XCP-ng 8.2+ are required.

sslbrain offers: RSA 2048/3072/4096. Supply the certificate as PEM with a matching unencrypted key.

XAPI requires a two-prime RSA key of 2048 to 4096 bits. The key is converted to PKCS#8; intermediates are ordered and the self-signed root omitted.