Creating and importing certificates signed by a certificate authority (CA) for your VMware Cloud Director appliance provides the highest level of trust for SSL communications and helps you secure the connections within your cloud.

Important:

Upon deployment, the VMware Cloud Director appliance generates self-signed certificates with a 2048-bit key size. You must evaluate your installation's security requirements before choosing an appropriate key size. Key sizes less than 1024 bits are no longer supported per NIST Special Publication 800-131A.

The private key password used in this procedure is the root user password, and it is represented as root_password.

Starting with VMware Cloud Director 10.4, both the console proxy traffic and HTTPS communications go over the default 443 port.

Note: VMware Cloud Director 10.4.1 and later do not support the legacy implementation of the console proxy feature.
Important: For certificates documentation for VMware Cloud Director 10.5.1 and later, see Certificate Management in the VMware Cloud Director Appliance 10.5.1 and Later. Starting with VMware Cloud Director 10.5.1, the certificates command of the cell management tool is deprecated. The certificates command appears to work correctly, but after a cell restart, the changes are not in effect because the cell no longer reads the certificate files from the files on-disk. In version 10.5.1 and later, VMware Cloud Director reads the certificates from the Certificates Library.

Prerequisites

To verify that this is the relevant procedure for your environment needs, familiarize yourself with SSL Certificate Creation and Management of Your VMware Cloud Director Appliance.

Procedure

  1. Log in directly or by using an SSH client to the VMware Cloud Director appliance console as root.
  2. Depending on your environment needs, choose one of the following options.
    When you deploy the VMware Cloud Director appliance, VMware Cloud Director automatically generates self-signed certificates with a 2048-bit key size for the HTTPS service and the console proxy service.
    • If you want your Certificate Authority to sign the certificates that are generated upon deployment, skip to Step 5.
    • If you want to generate new certificates with custom options, such as a greater key size, continue to Step 3.
  3. Run the command to back up the existing certificate files. 
    cp /opt/vmware/vcloud-director/etc/user.http.pem /opt/vmware/vcloud-director/etc/user.http.pem.original
cp /opt/vmware/vcloud-director/etc/user.http.key /opt/vmware/vcloud-director/etc/user.http.key.original
  4. Run the following commands to create public and private key pairs for the HTTPS service. 
    /opt/vmware/vcloud-director/bin/cell-management-tool generate-certs --cert /opt/vmware/vcloud-director/etc/user.http.pem --key /opt/vmware/vcloud-director/etc/user.http.key --key-password root-password

    The commands create or overwrite the certificate file by using the default values, and create or overwrite the private key file with the specified passwords. Depending on the DNS configuration of your environment, the Issuer Common Name (CN) is set to either the IP address or the FQDN for each service. The certificate uses the default 2048-bit key length and expires one year after creation.

    Important: Because of configuration restrictions in the VMware Cloud Director appliance, you must use the locations /opt/vmware/vcloud-director/etc/user.http.pem and /opt/vmware/vcloud-director/etc/user.http.key for the HTTPS certificate files.
    Note: You use the appliance root password as the key passwords.
  5. Create certificate signing requests (CSR) for the HTTPS service in the http.csr file. 
    openssl req -new -key /opt/vmware/vcloud-director/etc/user.http.key -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:vcd2.example.com,DNS:vcd2,IP:10.100.101.10\n")) -out http.csr
  6. Send the certificate signing requests to your Certificate Authority.
    If your certification authority requires you to specify a Web server type, use Jakarta Tomcat.
    You obtain the CA-signed certificates.
  7. Copy the CA-signed certificates, the CA root certificate, and any intermediate certificates to the VMware Cloud Director appliance and run the command to overwrite the existing user.http.pem cert on the appliance with your CA-signed version. 
    cp ca-signed-http.pem /opt/vmware/vcloud-director/etc/user.http.pem
  8. To append the root CA-signed certificate and any intermediate certificates to the HTTP and console proxy certificate, run the following command. 
    cat intermediate-certificate-file-1.cer intermediate-certificate-file-2.cer root-CA-certificate.cer >> /opt/vmware/vcloud-director/etc/user.http.pem
  9. To import the certificates into the VMware Cloud Director instance, run the following command. 
    /opt/vmware/vcloud-director/bin/cell-management-tool certificates -j --cert /opt/vmware/vcloud-director/etc/user.http.pem --key /opt/vmware/vcloud-director/etc/user.http.key --key-password root_password
  10. For the new signed certificates to take effect, restart the vmware-vcd service on the VMware Cloud Director appliance.
    1. Run the command to stop the service. 
      /opt/vmware/vcloud-director/bin/cell-management-tool cell -i $(service vmware-vcd pid cell) -s
    2. Run the command to start the service. 
      systemctl start vmware-vcd

What to do next