Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

Skip to main content

My Subscriptions

Loading

Knowledge Base

Creating custom certificates for vCenter Server with OpenSSL and Microsoft Certificate Services Web Enrollment (1003921)

Last Updated: 3/24/2017Categories: How toTotal Views: 10317Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

This article provides instructions to create custom SSL certificates for VirtualCenter/vCenter Server with OpenSSL and Microsoft Certificate Services Web Enrollment.

Note: This article assumes that you have already installed and configured a Microsoft Certificate Services Web Enrollment Root Certificate Authority (CA).

Solution

To create custom certificates:

Note: Run all commands from c:\openssl\bin.

Download and install OpenSSL for Windows.

Open the c:\openssl\bin\openssl.cnf file and enter your default information.

Note : This step saves time later in the procedure.

Follow the steps for your system:

For 32-bit systems:

Create the vCenter Server private key rui.key with this command:

openssl genrsa 1024 -out rui.key

Create the certificate signing request rui.csr with this command:

openssl req -new -key rui.key -out rui.csr -config openssl.cnf

Note: When prompted for the common name, enter the hostname of the vCenter Server.

For 64-bit systems:

Run the openssl command prompt from the installation directory C:\Users\Administrator\Desktop\openssl-0.9.8k_X64\bin\openssl.exe if installed in C:\Users\Administrator\Desktop\.

Run this command:

genrsa -out rui.key 1024

Create the certificate. When creating the certificate file, use the full path to the rui.key and openssl.cnf files:

openssl req -new -key "C:\Users\Administrator\Desktop\openssl-0.9.8k_X64\bin\rui.key" -out rui.csr -config "C:\Users\Administrator\Desktop\openssl-0.9.8k_X64\openssl.cnf"

Obtain the signed certificate rui.crt:

Open Internet Explorer, and browse to the Microsoft Certificate Services Web Enrollment server (Root CA). The URL is similar to:

http://root_ca/certsrv

Click Request a certificate > advanced certificate request.

Click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Open c:\openssl\bin\rui.csr in a text editor. Select and copy the contents of the file.

Paste the contents of the rui.csr file into the Saved request field.

Click Submit.

Have your certificate administrator issue your certificate on the MS Root CA.

Return to the home of the Web Enrollment server. Your request, along with the time you submitted it, is listed.

Click on your request.

Select Base 64 encoded.

Click Download CA certificate.

In the File Download window, browse to c:\openssl\bin and save the file as rui.crt.

To merge the server private key and the signed certificate into the file rui.pfx, run this command:

openssl pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx

Note: The password, testpassword, must not be changed.

To replace the certificates on vCenter Server:

Copy the existing rui.key, rui.crt, and rui.pfx files from C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\ to a backup folder.

Copy the custom rui.key, rui.crt, and rui.pfx files to C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\.

To load the new Certificates:

For vCenter Server 4.1 and later:

Use the Managed Object Browser (MOB) to reload the SSL Certificate. For more information, see Replacing vCenter Server 4.1 and 5.0 SSL certificates using the vpxd -p command fails with the error: failed to do early initialization (1030661).

Restart the VirtualCenter Management Webservices service. For more information, see Stopping, starting, or restarting vCenter services (1003895).

For VirtualCenter and vCenter Server 4.0 and earlier:

Stop the VirtualCenter Server service. For more information, see Stopping, starting, or restarting vCenter services (1003895) .

To reset your database password, browse to the root directory for your vCenter Server install and run this command:

vpxd.exe –p

When prompted for your new password, enter your existing database password.

When prompted to confirm your password, re-enter the password.

Start the VirtualCenter Server service. For more information, see Stopping, starting, or restarting vCenter services (1003895).

Install the root CA certificate into the trusted root CAs on the vCenter Server.

Log into your vCenter Server using your new certificate.

Reconnect all of your hosts. This forces them to communicate using the new SSL certificate.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
在 ESXi 主机上启用或禁用锁定模式 (1008077)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware VirtualCenter

VMware vCenter Server

Related Versions:

VMware VirtualCenter 2.5.x

VMware vCenter Server 5.0.x

VMware vCenter Server 4.1.x

VMware vCenter Server 4.0.x

Take Our Survey

Was this article helpful?

YES

NO

Copyright © 2005-2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.

Terms of Use

Your California Privacy Rights

Privacy

Accessibility

Cookie Settings

Support Assistant