Creating and importing CA-signed certificates provides the highest level of trust for SSL communications and helps you secure the connections within your cloud infrastructure.
Starting with VMware Cloud Director 10.4, both the console proxy traffic and HTTPS communications go over the default 443 port. You do not need a separate certificate for the console proxy.
For VMware Cloud Director 10.4, if you want to use the legacy implementation with a dedicated console proxy access point, you can enable the LegacyConsoleProxy feature from the Feature Flags settings menu under the Administration tab of the Service Provider Admin Portal. To enable the LegacyConsoleProxy feature, your installation or deployment must have console proxy settings configured in a previous version and transferred through a VMware Cloud Director upgrade. After enabling or deactivating the feature you must restart the cells. If you enable the legacy console proxy implementation, the console proxy must have a separate certificate. See the VMware Cloud Director 10.3 version of this document.
The certificate for the HTTPS endpoint must include an X.500 distinguished name and X.509 Subject Alternative Name extension.
You can use a certificate signed by a trusted certificate authority (CA) or a self-signed certificate.
You use the cell-management-tool
to create the self-signed SSL certificate. The cell-management-tool
utility is installed on the cell before the configuration agent runs and after you run the installation file. See Install VMware Cloud Director on the First Member of a Server Group.
Prerequisites
- Download and install OpenSSL.
- For more details on the available options for the
generate-certs
command, see Generating Self-Signed Certificates for the HTTPS and Console Proxy Endpoints. - For more details on the available options for the
certificates
command, see Replacing Certificates for the HTTPS Endpoint.
Procedure
What to do next
- If you have not yet configured your VMware Cloud Director instance, run the configure script to import the certificates to VMware Cloud Director. See Configure the Network and Database Connections.
Note: If you created the cert.pem or cert.key certificate files on a computer other than the server on which you generated the list of fully qualified domain names and their associated IP addresses, copy the cert.pem and cert.key files to that server now. You need the certificate and private key path names when you run the configuration script.
- If you have already installed and configured your VMware Cloud Director instance, use the certificates command of the cell management tool to import the certificates. See Replacing Certificates for the HTTPS Endpoint.