As part of the post-installation process, you might want to set up your Secure Sockets Layer (SSL) certificates. Setting up SSL certificates is optional when installing Automation Config, but recommended.
Before you start
Setting up the SSL certificates is one post-installation step in a series of several steps that should be followed in a specific order. First, complete one of the installation scenarios and then read the following post-installation pages:
Set up and configure SSL certificates
To create the SSL certificates:
- The
python36-pyOpenSSL
package is necessary to configure SSL after installation. This step is usually completed before installation. If you were unable to install it before installation, it can be installed now. For instructions about checking for and installing this dependency, see Required Automation Config dependencies. - Create and set permissions for the certificate folder for the RaaS service.
sudo mkdir -p /etc/raas/pki sudo chown raas:raas /etc/raas/pki sudo chmod 750 /etc/raas/pki
- Generate keys for the RaaS service using Salt, or provide your own.
sudo salt-call --local tls.create_self_signed_cert tls_dir=raas sudo chown raas:raas /etc/pki/raas/certs/localhost.crt sudo chown raas:raas /etc/pki/raas/certs/localhost.key sudo chmod 400 /etc/pki/raas/certs/localhost.crt sudo chmod 400 /etc/pki/raas/certs/localhost.key
- To enable SSL connections to Automation Config user interface, generate a PEM-encoded SSL certificate or ensure that you have access to an existing PEM-encoded certificate.
- Save the
.crt
and.key
files you generated in the previous step to/etc/pki/raas/certs
on the RaaS node. - Update the RaaS service configuration by opening
/etc/raas/raas
in a text editor. Configure the following values, replacing<filename>
with your SSL certificate filename:tls_crt:/etc/pki/raas/certs/<filename>.crt tls_key:/etc/pki/raas/certs/<filename>.key port:443
- Restart the RaaS service.
sudo systemctl restart raas
- Verify the RaaS service is running.
sudo systemctl status raas
- Confirm that you can connect to the user interface in a web browser by navigating to your organization’s custom Automation Config URL and entering your credentials. For more information about logging in, see Log in for the first time and change default credentials.
Your SSL certificates for Automation Config are now set up.
Updating SSL certificates
Instructions for updating SSL certificates for Automation Config are available at the VMware knowledge base. For more information, see How to update SSL certificates for Automation Config.
Troubleshooting Automation Config environments with VMware Aria Automation that use self-signed certificates
This information is for customers who are working with VMware Aria Automation deployments that use a certificate signed by a non-standard certificate authority.
Automation Config might experience the following symptoms:
- When you first open VMware Aria Automation, your web browser displays a security warning next to the URL or in the display page that the certificate cannot be validated.
- When you attempt to open the Automation Config user interface in your web browser, you might get a 403 error or a blank screen.
These symptoms might be caused if your VMware Aria Automation deployment is using a certificate signed by a non-standard certificate authority. To verify whether this is causing Automation Config to display a blank screen, SSH into the node that is hosting Automation Config and review the RaaS log file (/var/log/raas/raas
). If you find a traceback error message that indicates that self-signed certificates are not allowed, there are two options you can try to resolve the issue.
As a security best practice, you should never set up a production environment to use self-signed certificates or improperly signed certificates to authenticate VMware Aria Automation or Automation Config. The recommended practice is to use certificates from trusted certificate authorities instead.
If you choose to use self-signed or improperly signed certificates, you may put your system at serious risk of a security breach. Proceed with caution when using this procedure.
If you experience this problem and your environment needs to continue using a certificate signed by a non-standard certificate authority, there are two options available to you.
The first option is to add the VMware Aria Automation root certificate authority (CA) to your Automation Config environment. The second option is to disable VMware Aria Automation certificate validation in Automation Config.
Add the vRealize Automation root certificate authority (CA) to your Automation Config environment
This procedure requires:
- Root access
- The ability to SSH into the RaaS server
As an additional security best practice, only the most trusted and senior individuals at your organization should be granted this level of access. Take care to restrict root access to your environment.
You may find it easier to create a private certificate authority and sign your own VMware Aria Automation certificates with that certificate authority rather than using self-signed certificates. The advantage of this approach is you only have to go through this process once for every VMware Aria Automation certificate you need. Otherwise, you would have to go through this process for every vRealize Automation certificate you create. For more information about creating a private certificate authority, see How do you sign a certificate request with your own certification authority (Stack Overflow).
To add a certificate signed by a non-standard certificate authority to the list of certificate authorities in Automation Config:
- Attempt to open the vRealize Automation web interface in your browser. The certificate should display a warning message in the browser window and the URL display.
- Run the following script which gets and installs the certificate, replacing
<vra_fqdn>
with your VMware Aria Automation FQDN:echo -n | openssl s_client -connect <vra_fqdn>:443 -showcerts | tac | sed -ne '1,/-BEGIN CERTIFICATE-/p' | tac | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | tee -a /etc/pki/tls/certs/ca-bundle.crt && sed -i.bak '/ExecStart\=/iEnvironment=REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt' /usr/lib/systemd/system/raas.service && systemctl daemon-reload && systemctl stop raas && rm /var/log/raas/raas && systemctl start raas && echo -e 'Starting RaaS Service and tailing the log to see if errors persist. \n Please Wait' && sleep 10 && echo -e 'Relaunch the web browser and navigate to the vRASSC login page and monitor this screen for further errors.\n CTRL+C to exit the tail' && tail -f /var/log/raas/raas
- Verify that this solution has solved the problem by logging into the Automation Config web interface. If the problem has been resolved, Automation Config displays the Dashboard page.
Disable certificate validation
To disable certificate validation in Automation Config:
- Open the RaaS configuration file on the RaaS node, which is stored in
/etc/raas/raas
. - In the
vra
setting, set the value forvalidate_ssl
tofalse
. - Run
systemctl restart raas
to restart the RaaS service. - Verify that this solution has solved the problem by logging into the Automation Config web interface. If the problem has been resolved, Automation Config displays the Dashboard page.
What to do next
After setting up SSL certificates, you may need to complete additional post-installation steps.
If you are a Automation for Secure Hosts customer, the next step is to set up these services. For more information, see Configure Automation for Secure Hosts.
If you've completed all the necessary post-installation steps, the next step is to integrate Automation Config with VMware Aria Automation for Secure Hosts. See Configure an Automation Config integration in Aria Automation for more information.