VCF

VCF 9.1 Home Lab Series – Part 4: VCF Offline Depot

A field-tested guide to validating compute, network, name resolution and time services before beginning a VMware Cloud Foundation bring-up.

Welcome to part 4 of the VCF-9.1 home lab series. The previous post in this series discussed the pre-deployment planning and checklist. In this post, I will demonstrate setting up an offline depot for deploying a VCF 9.1 fleet.

The very first step after deploying the VCF installer is to connect it to a depot from where it can pull the installation binaries. The VCF Installer depot supports the following connection modes.

Connection Mode	Description
Online Depot	Internet connection is available (either directly or through a proxy server) for binary downloads.
Offline Depot	Dark site/Air gapped environment, and internet connectivity is not available.
Manual Transfer	The VCF Installer appliance cannot connect to an online or offline depot. The VCF Download Tool is used to download binaries to a computer with access to the Internet and then upload them to the installer appliance.

To setup offline depot, you need to deploy a web server with an SSL certificate. The certificate can be self-signed or signed by your internal CA.

The web server VM can be deployed using the following specs:

vCPU: 1
Memory: 2 GB
Boot Disk: 20 GB
Data Disk: 500 GB (1 TB recommended)
Network: Infra management network.

In my lab, I am using Ubuntu 24.04 for the web server deployment. I deployed the VM and enabled root access (SSH) and used the following commands to configure it.

1: Install Apache

root@vcf91-repo:~# apt install apache2 openssl apache2-utils unzip -yroot@vcf91-repo:~# ls -l /var/www/html/total 12-rw-r–r– 1 root root 10671 May 12 15:26 index.html

2: Format the Data Disk

root@vcf91-repo:~# lsblkNAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTSsda 8:0 0 30G 0 disk├─sda1 8:1 0 1G 0 part /boot/efi├─sda2 8:2 0 2G 0 part /boot└─sda3 8:3 0 26.9G 0 part └─ubuntu–vg-ubuntu–lv 252:0 0 13.5G 0 lvm /sdb 8:16 0 500G 0 disksr0 11:0 1 1024M 0 romroot@vcf91-repo:~# mkfs.ext4 /dev/sdbroot@vcf91-repo:~# echo “/dev/sdb /var/www/html ext4 defaults 1 1” >> /etc/fstabroot@vcf91-repo:~# mount -amount: (hint) your fstab has been modified, but systemd still uses the old version; use ‘systemctl daemon-reload’ to reload.root@vcf91-repo:~# systemctl daemon-reloadroot@vcf91-repo:~# df -hFilesystem Size Used Avail Use% Mounted ontmpfs 197M 1.1M 196M 1% /runefivarfs 256K 75K 177K 30% /sys/firmware/efi/efivars/dev/mapper/ubuntu–vg-ubuntu–lv 14G 4.7G 7.9G 38% /tmpfs 984M 0 984M 0% /dev/shmtmpfs 5.0M 0 5.0M 0% /run/lock/dev/sda2 2.0G 103M 1.7G 6% /boot/dev/sda1 1.1G 6.2M 1.1G 1% /boot/efitmpfs 197M 12K 197M 1% /run/user/0/dev/sdb 492G 28K 467G 1% /var/www/html

3: Generate Certs for web server

## Generate Certificate Signing Request ##root@vcf91-repo:~# openssl req -new -newkey rsa:2048 -nodes -keyout vcf91-repo.key -out vcf91-repo.csr -subj “/C=CA/ST=Ontario/L=YourCity/O=Thinkon/OU=Cloud-Services/CN=vcf91-repo.cmb1.thinkon.lab”## Send the CSR to the Microsoft CA and obtain the signed certificate file #### convert cer to crt ##root@vcf91-repo:~# cp vcf91-repo.cer vcf91-repo.crt## Verify the cert matches your private key ##root@vcf91-repo:~# openssl x509 -noout -modulus -in vcf91-repo.crt | md5sum82b59249e87a9c9193a94d42240c18d0 -root@vcf91-repo:~# openssl rsa -noout -modulus -in vcf91-repo.key | md5sum82b59249e87a9c9193a94d42240c18d0 –

4: Stage the signed certificates.

root@vcf91-repo:~# mkdir -p /etc/apache2/ssl/root@vcf91-repo:~# cp vcf91-repo.key vcf91-repo.crt /etc/apache2/ssl/root@vcf91-repo:~# chmod 600 /etc/apache2/ssl/vcf91-repo.keyroot@vcf91-repo:~# chmod 644 /etc/apache2/ssl/vcf91-repo.crtroot@vcf91-repo:~# systemctl restart apache2

5: Configure authentication.

root@vcf91-repo:~# htpasswd -c /etc/apache2/.htpasswd vcfadminNew password:Re-type new password:Adding password for user vcfadmin

6: Configure web server SSL settings.

root@vcf91-repo:~# vim /etc/apache2/sites-available/default-ssl.confSSLCertificateFile /etc/apache2/ssl/vcf91-repo.crtSSLCertificateKeyFile /etc/apache2/ssl/vcf91-repo.key<Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None AuthType Basic AuthName “VCF Depot” AuthUserFile /etc/apache2/.htpasswd Require valid-user</Directory>root@vcf91-repo:~# a2enmod ssl headersConsidering dependency mime for ssl:Module mime already enabledConsidering dependency socache_shmcb for ssl:Enabling module socache_shmcb.Enabling module ssl.See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.Enabling module headers.To activate the new configuration, you need to run: systemctl restart apache2 root@vcf91-repo:~# a2ensite default-sslEnabling site default-ssl.To activate the new configuration, you need to run: systemctl reload apache2 root@vcf91-repo:~# systemctl reload apache2root@vcf91-repo:~# apache2ctl configtestSyntax OK

7: Update the VCF Installer Truststore

Add the web server certificate to the trusted store of the VCF installer appliance.

root@vcf91-repo:/etc/apache2/ssl# scp vcf@vcf910-installer.cmb1.thinkon.lab:/home/vcfroot@vcf910-installer [ ~ ]# keytool -import -trustcacerts -cacerts -storepass changeit -alias vcfRepoCert -file vcf91-repo.crt -nopromptCertificate was added to keystoreroot@vcf910-installer [ ~ ]# keytool -list -cacerts -storepass changeit | grep -i vcfrepovcfrepocert, May 15, 2026, trustedCertEntry,

Note: This step is very important. If you don’t add the cert to the truststore, you will encounter the invalid credentials error (misleading) when configuring depot settings in the installer appliance.

The web server configuration is now completed. The next step is to download the installation binaries.

8: Install VCF Download Tool

Download the VCD Download Tool from Broadcom’s support portal and upload it to the web server.

root@vcf91-repo:~# mkdir vdt910root@vcf91-repo:~# tar -zxvf vcf-download-tool-9.1.0.0.25371089.tar.gz -C vdt910## Add VCF download tool executable to the environment variables ##root@vcf91-repo:~# cat /etc/environmentPATH=”/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/root/vdt910/bin/”root@vcf91-repo:~# vcf-download-tool -v*********Welcome to VCF Download Tool***********Version: 9.1.0.0.253710899.1.0.0.25371089Log file: /root/vdt910/log/vdt.log

9: Generate Software Depot ID

In VCF 9.0, you needed the download token to download the installation binaries. This has changed in VCF 9.1. Now you need to register the software depot (your web server) in the VCF Business portal to obtain an activation code.

root@vcf91-repo:~# vcf-download-tool configuration generate –software-depot-id*********Welcome to VCF Download Tool***********Version: 9.1.0.0.25371089Use this link to register https://vcf.broadcom.net/vcf/clm/download-manager/register?serviceId=164180de-9b7e-48a3-8b78-5f1689d17b9e. Alternatively login at https://vcf.broadcom.com, select Software depot Registration and use this Software depot ID: 164180de-9b7e-48a3-8b78-5f1689d17b9e

10: Obtain Activation Code

Login to the VCF Business Services console and navigate to Software Depot Registrations. Click the Register Software Depot button.

Enter your software depot ID and a friendly name for the registration. Click the Register button, and the activation code will be printed on the screen.

Copy the activation code and store it in a secure location.

The depot is registered now.

11: List and download the installation binaries.

root@vcf91-repo:~# vcf-download-tool binaries list –sku VCF –vcf-version 9.1.0.0 –depot-download-activation-code-file activation-code.txt –type INSTALL –automated-install

Initiate the binaries’ download.

root@vcf91-repo:~# vcf-download-tool binaries download –depot-download-activation-code-file activation-code.txt –vcf-version 9.1.0.0 –depot-store /var/www/html –automated-install –type INSTALL

The download process can take a while, depending on your internet speed. The download summary is printed on the screen after the tool has finished the download process.