Today I was working on replacing SSL certificates on my vRealize IaaS server so as to complete the SSL certificate replacement on all vRealize components that I have deployed in my lab.

I am not going to cover here the steps needed to generate signed SSL certificates as I have covered them in my earlier  blog posts. If you are looking for Step by Step demonstration of the same please have a look on this Article Grant Orchard.

After replacing the IaaS SSL certificates, IaaS Server needs to re-register the new certificates to the vRA Appliance. The commands used to achieve this is as follows:

Note: vra1.alex.local is the name of my vRA appliance. Replace this with your appliance FQDN.

When I ran the above commands all of them was failing with below error messages.

Note: I have not included the full error message and only included the part which were making some sense (in Italics) as its too long to paste entire error message here.

As you can see from above error message that something was wrong with my SQL Server. I was scratching my head what could have gone wrong. I decided to test my SQL server connectivity first.

I launched SQL management studio and tried connecting to the vRA-IaaS DB instance using ‘sa’ user. It failed and I was wondering why. Then I decided to give a shot to the windows authentication method (as sometimes my ‘sa’ user have thrown tantrum at me)

To my surprise windows authentication was also not working.

Then I checked whether or not SQL services are running (of course this I should have checked at first place) and found SQL services were dead.

I understood what was wrong. Before replacing the SSL certs when I tried login to IaaS server using the service account ‘svcvcac’ as visible in above screenshots, Windows was telling me that password has expired and needs to be changed.

I forgot that I have configured the same service account to be used in my SQL server (I should have used a separate dedicated one for sql) and due to password change SQL services died as SQL is using this service account to run as.

I changed the password to original password (at the time of IaaS installation) and restarted my SQL services which started without any issues.

Now it was time to re-run the certificate re-register commands. This time all the commands completed successfully.

Lessons learnt from this mistake can be summarized as:

1: Service accounts should have “Password Never Expire” or longer duration for password expiry then any other normal domain user accounts

2: Use a dedicated service accounts for SQL servers.

Again I would say mistakes are essential for us to teach us really good lessons.

I hope you enjoyed reading this post. Feel free to share this on social media if it is worth sharing. Be sociable 🙂