Loading

×Sorry to interrupt
This page has an error. You might just need to refresh it.
[NoErrorObjectAvailable] Uncaught ReferenceError: addCTracking is not defined
Failing descriptor: {markup://c:KM_ArticleThemeLayout}

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Smarts: How to install ssl certs in SMARTS (520327)

Last Updated: 3/31/2021Categories: How toTotal Views: 3072Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Purpose

Smarts supports the use of self signed and signed SSL certificates.
This article shows the user on how to implement them.

Resolution

Smarts apps will by default on startup auto create a self signed ssl cert.

To create and implement self signed certificate

Note: CERTNAME will be the instance name ie  INCHARGE-SA-PRES as displayed in brcontrol
Exception: The broker, it will be named dmbroker

Create tls directory if it isnt present
mkdir <smarts_home>/SAM/smarts/local/conf/tls

Generate key file
cd to <smarts_home>/SAM/smarts/local/conf/tls
openssl genrsa 2048 > INCHARGE-OI.key

Example:

Generate crt file
openssl req -new -x509 -nodes -sha1 -days 365 -key localhost.key > CERTNAME.crt

Example:

Verify the cert and key
openssl x509 -noout -modulus -in  INCHARGE-OI.crt | openssl md5
openssl rsa -noout -modulus -in  INCHARGE-OI.key | openssl md5

Example:

Note that the outputs match.

Find the port number the service is running on
run brcontrol to find the port number of the instance you installed the ssl cert for
<smarts_home>/SAM/smarts/bin/brcontrol |grep INCHARGE-OI

Example:

Note the INCHARGE-OI is running on 49422

Test of see if the ssl cert has been installed properly
Verify that the able info matches the info in your ssl cert

openssl s_client -no_tls1 -no_ssl3 -connect localhost:49422

Example:

Check your instance log file and make sure that generating self-signed certificate isnt present.
grep "generating self-signed certificate" INCHARGE-OI_en_US_UTF-8.log

If the self-signed certificate endtry is not present in the logs and the openssl returns the correct cert info, the cert is installed and working properly.

To install a signed SSL Certificate

1) Create a Certificate Signing Request (CSR) and Private key

Run the following command on the smarts server, replace server with the fqdn name of your server.

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

2) Enter your CSR details

Enter the following CSR details when prompted:

Common Name: The FQDN (fully-qualified domain name) you want to secure with the certificate such as www.google.com, secure.website.org, *.domain.net, etc.

Organization: The full legal name of your organization including the corporate identifier.

Organization Unit (OU): Your department such as ‘Information Technology’ or ‘Website Security.’

City or Locality: The locality or city where your organization is legally incorporated. Do not abbreviate.

State or Province: The state or province where your organization is legally incorporated. Do not abbreviate.

Country: The official two-letter country code (i.e. US, CH) where your organization is legally incorporated.

3) Submit the newly created CSR to your ssl certificate issuer.

Note: the certificate needs to be in x509 format.

4) After the issuer has issued the domain certificate, copy the cert and key to the smarts/local/conf/tls directory and name the certificate and key to match your domain name, ie: INCHARGE-SA-PRES as displayed in brcontrol

Exception: The broker, it will be named dmbroker

Create tls directory if it isnt present

mkdir <smarts_home>/SAM/smarts/local/conf/tls

5) After the certificate is in place, you will need to restart your domain.

6) Copy the supplied intermediate certificate to the following directory

/etc/ssl/certs

7) Copy the supplied root certificate to the following directory

/etc/pki/ca-trust/source/anchors

8) Update the openssl certificate db

run the following command:

update-ca-trust extract

9) Verify that the installed domain certificate chain is valid

run the following command and verify that the return code is 0

openssl s_client -showcerts -connect smartshost:domain_port_number

Verify that the last return code is 0 (ok)

10) The ssl cert has been install properly and verified

NOTE:  Smarts does not currently support intermediate and root certificates.  The system querying smarts must provide those certificates, ie security scanners, etc.  Support for these certificates is planned in a future release.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

VMware Smart Assurance - SMARTS

Take Our Survey

Support Assistant