PowerStore: How to Renew the PowerStore VASA Storage Provider Certificate After Expiration

The VMware vSphere APIs for Storage Awareness (VASA) storage provider certificate can be refreshed in vCenter using the Refresh certificate feature before the certificate expires. If the certificate is allowed to expire before refreshing the certificate, the Refresh feature does not work.

1. Renew the certificate using PowerStore CLI or RestAPI using the "curl" command in Windows or Linux:

   PowerStore CLI (PSTCLI)

   pstcli -ssl accept -u admin -p <adminPassword> -d <PowerStore-Cluster-IP> x509_certificate reset_certificates -service VASA_HTTP

   RestAPI/curl

   curl -X POST "https://<PowerStore-Cluster-IP>/api/rest/x509_certificate/reset_certificates" -H "accept: application/json" -H "Content-Type: application/json" -d "{ \"service\": \"VASA_HTTP\"}" -u admin -k

   NOTE: Keep in mind that the curl command does not display any error message if the wrong account password is submitted

2. Verify the certificate expiration date.

   1. Open the PowerStore Manager user interface (UI).
   2. Click Settings > Security > Certificates.
   3. Locate the certificate with the following attributes:
      • Service: VASA HTTP
      • Type: Server
      • Scope: VASA
      

3. In vSphere, manually remove and add the VASA storage provider.

   1. Open the vSphere web UI.
   2. Under the Hosts and Clusters view, in the left pane click the top vCenter.
   3. Click the Configure tab, and click Storage Providers.
   4. Click the PowerStore VASA provider that is in the offline state, and click Remove.
      
   5. Click Add, and enter the following in the "Add dialog" screen:

      URL: https://:8443/version.xml
      User name: admin
      Password: 
      Clear the Use storage provider certificate option.

4. After adding the PowerStore VASA provider, check the datastore status. If it has not changed, then one last step to try is going into the PowerStore Manager and disconnecting and reconnecting.

   1. Go to Compute > vCenter Server Connection > click Disconnect > Finish loading the changes > click Connect and enter the vCenter information.
      
   2. Once done this allows the generation of a new certificate.