Generate a Certificate Signing Request for an Edge Gateway

Before you can order a signed certificate from a CA or create a self-signed certificate, you must generate a Certificate Signing Request (CSR) for your edge gateway.

A CSR is an encoded file that you need to generate on an NSX edge gateway which requires an SSL certificate. Using a CSR standardizes the way that companies send their public keys together with information that identifies their company names and domain names.

You generate a CSR with a matching private-key file that must remain on the edge gateway. The CSR contains the matching public key and other information such as the name, location, and domain name of your organization.

Procedure

1. Open Edge Gateway Services.
   1. In the top navigation bar, click Networking and click Edge Gateways.
   2. Select the edge gateway that you want to edit and click Services.
2. Click the Certificates tab.
3. On the Certificates tab, click CSR.
4. Configure the following options for the CSR:

   Option	Description
   Common Name	Enter the fully qualified domain name (FQDN) for the organization that you will be using the certificate for (for example, www.example.com). Do not include the http:// or https:// prefixes in your common name.
   Organization Unit	Use this field to differentiate between divisions within your VMware Cloud Director organization with which this certificate is associated. For example, Engineering or Sales.
   Organization Name	Enter the name under which your company is legally registered. The listed organization must be the legal registrant of the domain name in the certificate request.
   Locality	Enter the city or locality where your company is legally registered.
   State or Province Name	Enter the full name (do not abbreviate) of the state, province, region, or territory where your company is legally registered.
   Country Code	Enter the country name where your company is legally registered.
   Private Key Algorithm	Enter the key type, either RSA or DSA, for the certificate. RSA is typically used. The key type defines the encryption algorithm for communication between the hosts. When FIPS mode is on, RSA key sizes must be greater or equal to 2048 bits. Note: SSL VPN-Plus supports RSA certificates only.
   Key Size	Enter the key size in bits. The minimum is 2048 bits.
   Description	(Optional) Enter a description for the certificate.

5. Click Keep.
   The system generates the CSR and adds a new entry with type CSR to the on-screen list.

Results

In the on-screen list, when you select an entry with type CSR, the CSR details are displayed in the screen. You can copy the displayed PEM formatted data of the CSR and submit it to a certificate authority (CA) to obtain a CA-signed certificate.

What to do next

Use the CSR to create a service certificate using one of these two options:

• Transmit the CSR to a CA to obtain a CA-signed certificate. When the CA sends you the signed certificate, import the signed certificate into the system. See Import the CA-Signed Certificate Corresponding to the CSR Generated for an Edge Gateway.
• Use the CSR to create a self-signed certificate. See Configure a Self-Signed Service Certificate.