Welcome to part 4 of the VCF-9.1 home lab series. The previous post in this series discussed the pre-deployment planning and checklist. In this post, I will demonstrate setting up an offline depot for deploying a VCF 9.1 fleet.
If you are not following along, I encourage you to read the earlier parts of this series from the links below:
3: VCF 9.1 Pre-Deployment Planning
The very first step after deploying the VCF installer is to connect it to a depot from where it can pull the installation binaries. The VCF Installer depot supports the following connection modes.
| Connection Mode | Description |
| Online Depot | Internet connection is available (either directly or through a proxy server) for binary downloads. |
| Offline Depot | Dark site/Air gapped environment, and internet connectivity is not available. |
| Manual Transfer | The VCF Installer appliance cannot connect to an online or offline depot. The VCF Download Tool is used to download binaries to a computer with access to the Internet and then upload them to the installer appliance. |
To setup offline depot, you need to deploy a web server with an SSL certificate. The certificate can be self-signed or signed by your internal CA.
The web server VM can be deployed using the following specs:
- vCPU: 1
- Memory: 2 GB
- Boot Disk: 20 GB
- Data Disk: 500 GB (1 TB recommended)
- Network: Infra management network.
In my lab, I am using Ubuntu 24.04 for the web server deployment. I deployed the VM and enabled root access (SSH) and used the following commands to configure it.
1: Install Apache
|
1 2 3 4 5 |
root@vcf91-repo:~# apt install apache2 openssl apache2-utils unzip -y root@vcf91-repo:~# ls -l /var/www/html/ total 12 -rw-r--r-- 1 root root 10671 May 12 15:26 index.html |
2: Format the Data Disk
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
root@vcf91-repo:~# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sda 8:0 0 30G 0 disk ├─sda1 8:1 0 1G 0 part /boot/efi ├─sda2 8:2 0 2G 0 part /boot └─sda3 8:3 0 26.9G 0 part └─ubuntu--vg-ubuntu--lv 252:0 0 13.5G 0 lvm / sdb 8:16 0 500G 0 disk sr0 11:0 1 1024M 0 rom root@vcf91-repo:~# mkfs.ext4 /dev/sdb root@vcf91-repo:~# echo "/dev/sdb /var/www/html ext4 defaults 1 1" >> /etc/fstab root@vcf91-repo:~# mount -a mount: (hint) your fstab has been modified, but systemd still uses the old version; use 'systemctl daemon-reload' to reload. root@vcf91-repo:~# systemctl daemon-reload root@vcf91-repo:~# df -h Filesystem Size Used Avail Use% Mounted on tmpfs 197M 1.1M 196M 1% /run efivarfs 256K 75K 177K 30% /sys/firmware/efi/efivars /dev/mapper/ubuntu--vg-ubuntu--lv 14G 4.7G 7.9G 38% / tmpfs 984M 0 984M 0% /dev/shm tmpfs 5.0M 0 5.0M 0% /run/lock /dev/sda2 2.0G 103M 1.7G 6% /boot /dev/sda1 1.1G 6.2M 1.1G 1% /boot/efi tmpfs 197M 12K 197M 1% /run/user/0 /dev/sdb 492G 28K 467G 1% /var/www/html |
3: Generate Certs for web server
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
## Generate Certificate Signing Request ## root@vcf91-repo:~# openssl req -new -newkey rsa:2048 -nodes -keyout vcf91-repo.key -out vcf91-repo.csr -subj "/C=CA/ST=Ontario/L=YourCity/O=Thinkon/OU=Cloud-Services/CN=vcf91-repo.cmb1.thinkon.lab" ## Send the CSR to the Microsoft CA and obtain the signed certificate file ## ## convert cer to crt ## root@vcf91-repo:~# cp vcf91-repo.cer vcf91-repo.crt ## Verify the cert matches your private key ## root@vcf91-repo:~# openssl x509 -noout -modulus -in vcf91-repo.crt | md5sum 82b59249e87a9c9193a94d42240c18d0 - root@vcf91-repo:~# openssl rsa -noout -modulus -in vcf91-repo.key | md5sum 82b59249e87a9c9193a94d42240c18d0 - |
4: Stage the signed certificates.
|
1 2 3 4 5 6 7 8 |
root@vcf91-repo:~# mkdir -p /etc/apache2/ssl/ root@vcf91-repo:~# cp vcf91-repo.key vcf91-repo.crt /etc/apache2/ssl/ root@vcf91-repo:~# chmod 600 /etc/apache2/ssl/vcf91-repo.key root@vcf91-repo:~# chmod 644 /etc/apache2/ssl/vcf91-repo.crt root@vcf91-repo:~# systemctl restart apache2 |
5: Configure authentication.
|
1 2 3 4 |
root@vcf91-repo:~# htpasswd -c /etc/apache2/.htpasswd vcfadmin New password: Re-type new password: Adding password for user vcfadmin |
6: Configure web server SSL settings.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
root@vcf91-repo:~# vim /etc/apache2/sites-available/default-ssl.conf SSLCertificateFile /etc/apache2/ssl/vcf91-repo.crt SSLCertificateKeyFile /etc/apache2/ssl/vcf91-repo.key <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None AuthType Basic AuthName "VCF Depot" AuthUserFile /etc/apache2/.htpasswd Require valid-user </Directory> root@vcf91-repo:~# a2enmod ssl headers Considering dependency mime for ssl: Module mime already enabled Considering dependency socache_shmcb for ssl: Enabling module socache_shmcb. Enabling module ssl. See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates. Enabling module headers. To activate the new configuration, you need to run: systemctl restart apache2 root@vcf91-repo:~# a2ensite default-ssl Enabling site default-ssl. To activate the new configuration, you need to run: systemctl reload apache2 root@vcf91-repo:~# systemctl reload apache2 root@vcf91-repo:~# apache2ctl configtest Syntax OK |
7: Update the VCF Installer Truststore
Add the web server certificate to the trusted store of the VCF installer appliance.
|
1 2 3 4 5 6 7 |
root@vcf910-installer [ ~ ]# keytool -import -trustcacerts -cacerts -storepass changeit -alias vcfRepoCert -file vcf91-repo.crt -noprompt Certificate was added to keystore root@vcf910-installer [ ~ ]# keytool -list -cacerts -storepass changeit | grep -i vcfrepo vcfrepocert, May 15, 2026, trustedCertEntry, |
Note: This step is very important. If you don’t add the cert to the truststore, you will encounter the invalid credentials error (misleading) when configuring depot settings in the installer appliance.
The web server configuration is now completed. The next step is to download the installation binaries.
8: Install VCF Download Tool
Download the VCD Download Tool from Broadcom’s support portal and upload it to the web server.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
root@vcf91-repo:~# mkdir vdt910 root@vcf91-repo:~# tar -zxvf vcf-download-tool-9.1.0.0.25371089.tar.gz -C vdt910 ## Add VCF download tool executable to the environment variables ## root@vcf91-repo:~# cat /etc/environment PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/root/vdt910/bin/" root@vcf91-repo:~# vcf-download-tool -v *********Welcome to VCF Download Tool*********** Version: 9.1.0.0.25371089 9.1.0.0.25371089 Log file: /root/vdt910/log/vdt.log |
9: Generate Software Depot ID
In VCF 9.0, you needed the download token to download the installation binaries. This has changed in VCF 9.1. Now you need to register the software depot (your web server) in the VCF Business portal to obtain an activation code.
|
1 2 3 4 5 |
root@vcf91-repo:~# vcf-download-tool configuration generate --software-depot-id *********Welcome to VCF Download Tool*********** Version: 9.1.0.0.25371089 Use this link to register https://vcf.broadcom.net/vcf/clm/download-manager/register?serviceId=164180de-9b7e-48a3-8b78-5f1689d17b9e. Alternatively login at https://vcf.broadcom.com, select Software depot Registration and use this Software depot ID: 164180de-9b7e-48a3-8b78-5f1689d17b9e |
10: Obtain Activation Code
Login to the VCF Business Services console and navigate to Software Depot Registrations. Click the Register Software Depot button.
Enter your software depot ID and a friendly name for the registration. Click the Register button, and the activation code will be printed on the screen.
Copy the activation code and store it in a secure location.
The depot is registered now.
11: List and download the installation binaries.
|
1 |
root@vcf91-repo:~# vcf-download-tool binaries list --sku VCF --vcf-version 9.1.0.0 --depot-download-activation-code-file activation-code.txt --type INSTALL --automated-install |
Initiate the binaries’ download.
|
1 |
root@vcf91-repo:~# vcf-download-tool binaries download --depot-download-activation-code-file activation-code.txt --vcf-version 9.1.0.0 --depot-store /var/www/html --automated-install --type INSTALL |
The download process can take a while, depending on your internet speed. The download summary is printed on the screen after the tool has finished the download process.
12: (optional) Validate the binaries are downloaded in the repo.
Verify that you can see the same when you access the web server document root in the UI.
13: Configure repo in the VCF Installer appliance.
Login to the VCF installer appliance and edit the depot settings.
Enter the web server FQDN and the credentials that you configured in step 5.
On successful authentication, the depot will be configured, and the depot connection will report active.
14: Initiate download of the installation binaries.
And that’s it for this post. In the next post of this series, I will demonstrate the deployment of the VCF management domain.
I hope you enjoyed reading this post. Feel free to share this on social media if it is worth sharing.
Hi ,
Thank you so much for sharing your knowlege.
I have done all thing like your post, in browser it works, but in vcf installer still show me:
7: Update the VCF Installer Truststore is ok form me, I have done like your post and got like your output.
Failed to connect to VMware depot with the provided user credentials. Cause: Depot connection failure: Secure protocol communication error, host: itsp-vcf91repo.it-sp.ch, http status code: .
Please verify the depot credentials for user are correct, check your connection to the depot and try command again.
Hi,
After three tries, it works.
Issue Downloading Log Management Bundle from Offline Depot
Hi,
First of all, thank you so much for the information you shared with us.
I am currently facing an issue, and I would like to explain it:
I installed the VCF Installer, then deployed the Offline Depot following your guide, and updated the VCF Installer truststore successfully.
After the installation, I tried to install Log Management by navigating to:
VCF Operations > Build > Lifecycle > VCF Management > Components > Add Component > Log Management
However, I am unable to download the required bundle.
I believe I may also need to update the truststore on the SDDC Manager or VCF Operations side, but I am not sure about the correct steps.
Could you please let me know how I can fix this issue?
Thank you in advance for your help.
Hi Jawad, in Greenfield installation, VCF installer adds the offline depo cert to VCF OPS automatically. In my lab, I never had to do this manually. Check the lcm-debug.log file on the sddc manager and see why exactly the download is failing.