Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

NSX Defender - Custom SSL/TLS certificates for the web portal on a Manager/Analyst/Pinbox (900128)

Last Updated: 6/22/2022Categories: InformationalTotal Views: 1609Language:
English

2 like this article

Subscribe to get an email
newsletter with new updates

2 people found this helpful Please provide article feedback:

Details

It is possible to replace the SSL/TLS certificate for HTTPS on a Manager (or Pinbox/Analyst).

Requirements (assuming your manager FQDN is manager.aaa.com)

Will need to be valid for

user.manager.aaa.com

user.standby.manager.aaa.com

update.manager.aaa.com

log.manager.aaa.com

We recommend using "user.manager.aaa.com" as commonName for the cert, and then specify all four as Subject Alternative Name. In this way user.manager.aaa.com will work even for clients that does not support SAN.

Wild cards are supported, but will only cover 1 level of subdomains. (i.e *.manager.aaa.com will only cover user.manager.aaa.com, update.manager.aaa.com and log.manager.aaa.com, and not user.standby.manager.aaa.com)

The certificate needs to be in x509 format. Intermediate CA certificates need to be appended to the server certificate file

The private key must not have a passphrase

You will need the entire certificate chain

The certificate must be trusted by all appliances (i.e. signed by a CA trusted by Ubuntu 12.04 or manually added to the trusted set of certificates; see the Adding an SSL certificate to the trusted set section below).

Be sure you also deploy the new certificate to any proxy that may also be serving the certificate.

How to deploy a new certificate on the manager/analyst/pinbox:

store the certificate as /etc/puppet/files/ssl-cert/user.manager.aaa.com.pem
(if you have an intermediate certificate, you can combine it with your primary certificate into one single file and put here)

 Be sure to make a backup of the original file incase you need to revert the process.

File names in linux are case sensitive and this file need to be in all lower case

store the private key as /etc/puppet/private/ssl-priv-key/user.manager.aaa.com.key

 Be sure to make a backup of the original file incase you need to revert the process.

File names in linux are case sensitive and this file need to be in all lower case

run lastline_apply_config. This step will also restart nginx.

Adding an SSL certificate to the trusted set

In order to add certificates to the set of certificates trusted by an appliance, the following steps need to be performed on all appliances:

Store the certificate in the /usr/local/share/ca-certificates/ directory, making sure the extension is .crt.

You will need to be sure to include the Intermediate and Root certificate (in separate files or a single crt file) as well to ensure the new certificate is trusted.

Execute update-ca-certificates

This step must be completed on all appliances (including the manager itself).

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
修改在 vSAN 数据存储中的快照上运行的虚拟机上的存储策略规则 (70797)

KB
•
Windows 10 Wi-Fi プロファイルがインストールされない (85058)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware NSX Detonator

VMware NSX Defender

Related Versions:

Take Our Survey

Support Assistant