The Identity Appliance uses lighttpd to run its own management site. You can replace the SSL certificate of the management site service, for example, if your certificate expires or if you are using a self-signed certificate and your company security policy requires you to use its SSL certificates. You secure the management site service on port 5480.


To install a new certificate, the certificate must be in PEM format and the private key cannot be encrypted. By default the Identity Appliance management site SSL certificate and private key are stored in a PEM file located at /opt/vmware/etc/lighttpd/server.pem.

See Extracting Certificates and Private Keys if you require information about exporting a certificate and private key from a Java keystore to a PEM file.


  1. Log in by using the appliance console or SSH.
  2. Back up your current certificate file.
    cp /opt/vmware/etc/lighttpd/server.pem /opt/vmware/etc/lighttpd/server.pem-bak
  3. Copy the new certificate to your appliance by replacing the content of the file /opt/vmware/etc/lighttpd/server.pem with the new certificate information.
  4. Run the following command to restart the lighttpd server.

    service vami-lighttp restart

  5. Log in to the management console and validate that the certificate is replaced. You might need to restart your browser.


The new Identity Appliance management site certificate is installed.