An administrator attempts to configure a Microsoft Certificate Authority in VMware Cloud Foundation (VCF) Operations supplying a certificate template name of VMware. The attempt fails with error…

Question

Options

• AThe user account has only the "Enroll" permission on the certificate template.
• BThe user account does not have the "Enroll" permission on the certificate template.
• CThe user account does not have the "Read" and "Autoenroll" permission on the certificate
• DThe user account has only the "Read" and "Enroll" permission on the certificate template.

• A
  80% (16)
• B
  10% (2)
• C
  5% (1)
• D
  5% (1)

Explanation

To successfully configure a Microsoft Certificate Authority (CA) in VMware Cloud Foundation (VCF) Operations (formerly vRealize/Aria Operations), the service account used for the integration must have specific permissions on the Certificate Template (e.g., the "VMware" Required Permissions: The VCF 9.0 and Aria Operations documentation explicitly states that the service account must be assigned Read and Enroll permissions on the target Certificate Read: This permission is critical for the "Discovery" and "Validation" phase. It allows VCF Operations to query the CA, list available templates, and read the template's properties (like Key Usage and Extended Key Usage) to ensure they meet the security requirements (e.g., Server Authentication, Non-Repudiation). Enroll: This permission allows the account to actually submit a Certificate Signing Request (CSR) via the interface and receive a signed certificate. The Cause of Failure (Option A): If the user account is configured with only the "Enroll" permission, it effectively lacks the "Read" permission. Without "Read", VCF Operations cannot "see" or validate the template during the configuration wizard. The application attempts to fetch the template details, fails (because the template is invisible to it), and throws the error "Certificate authorities update failed."

No community discussion yet for this question.