Knowledge Base

• Creating the certificate request
• Getting the certificate
• Installation and configuration of the certificate in the vSphere Web Client and the Log Browser

• You have a vSphere 5.1 environment
• All certificates and corresponding files are already generated, as per Implementing CA signed SSL certificates with vSphere 5.1 (2034833).

Installing and configuring the certificate for the vSphere Web Client and the Log Browser

1. Log into the vSphere Web Client server as an administrator.
2. If you have not already imported it, double click on the C:\certs\Root64.cer file and import the certificate into the Trusted Root Certificate Authorities > Local Computer Windows certificate store. This ensures that the certificate server is trusted.
3. Stop the VMware vSphere Web Client service from the service control manager (services.msc).
4. Stop the VMware Log Browser Service from service control manager (services.msc).
5. Back up the current certificates (rui.crt, rui.key, rui.pfx) for the vSphere Web Client. By default, the certificates are located in:
   
   Windows 2008: C:\ProgramData\VMware\vSphere Web Client\ssl\
   
   Windows 2003: C:\Documents and Settings\All Users\Application Data\VMware\vSphere Web Client\ssl
   
   
6. Copy the new certificate files to this directory. If you are following this resolution path, the certificates are located in C:\certs\WebClient.
7. Back up the current certificates for the Log Browser. By default, the certificates are located in:
   
   C:\Program Files\VMware\Infrastructure\vSphereWebClient\logbrowser\conf
   
   
8. Copy the new certificate files (rui.crt, rui.key, rui.pfx) to this directory. If you are following this resolution path, the certificates are located in C:\certs\logbrowser.
9. From the command prompt, run:
   
   set JAVA_HOME=c:\Program Files\VMware\Infrastructure\JRE
   
   
10. Navigate to the SsoRegTool directory. The default location for this directory is:
    
    C:\Program Files\VMware\Infrastructure\vSphereWebClient\SsoRegTool\
    
    
11. Unregister the vSphere Web Client Service from SSO by running the command:
    
    Note: The unregisterService command from within the regTool.cmd file is case sensitive.
    
    regTool.cmd unregisterService -si "Installation_Directory\vSphereWebClient\serviceId" -d https://SSOServer.domain.com:7444/lookupservice/sdk -u admin@System-Domain -p password
    
    Where:
    • Installation_Directory by default is C:\Program Files\VMware\Infrastructure
    • password is the admin@system-domain password
    
    If the command is successful, the output appears similar to:
    
    
    
    
12. Register the VMware vSphere Web Client back to vCenter Single Sign On:
    
    Note: The registerService command from within the regTool.cmd file is case sensitive.
    
    
    • On Windows 2008, run the command:
      
      regTool.cmd registerService --cert "C:\ProgramData\VMware\vSphere Web Client\ssl" --ls-url https://SSOServer.domain.com:7444/lookupservice/sdk --username admin@System-Domain --password password --dir "Installation_Directory\vSphereWebClient\SsoRegTool\sso_conf" --ip "*.*" --serviceId-file "Installation_Directory\vSphereWebClient\serviceId"
      
      
    • On Windows 2003, run the command:
      
      regTool.cmd registerService --cert "C:\Documents and Settings\All Users\Application Data\VMware\vSphere Web Client\ssl" --ls-url https:// SSOServer.domain.com:7444/lookupservice/sdk --username admin@System-Domain --password password --dir "Installation_Directory\vSphereWebClient\SsoRegTool\sso_conf" --ip "*.*" --serviceId-file "Installation_Directory\vSphereWebClient\serviceId"
    
    Where:
    • Installation_Directory by default is C:\Program Files\VMware\Infrastructure
    • password is the admin@system-domain password
    
    If the command is successful, the output appears similar to:
    
    
    
    
13. Open the Installation_Directory\vSphereWebClient\serviceId file in a text editor and remove the two old service lines. In this example, the old lines end in :9 and :10 (shown in the screenshot from step 11) and the new lines end with :14 and :15 (shown in the screenshot from step 12). There should only be the two lines in the file corresponding to the registered services in the screenshot in step 12.
    
    After editing, the file looks similar to:
    
    
    
    
14. Start the VMware vSphere Web Client service from the service control manager. It may take about 5 minutes to initialize fully.
15. Start the VMware vSphere Log Browser service from the service control manager.
16. To test that the certificate is valid, log into the vSphere Web Client and check that the Inventory is accessible and that the certificate is properly installed.
17. If they are not on separate servers or you cannot restart the server, stop and start the services in this order:
    
    • Stop the VMware Log Browser service.
    • Stop the VMware vSphere Web Client service
    • Stop the VMware VirtualCenter Server service
    • Stop the VMware vCenter Inventory service
    • Stop the vCenter Single Sign On service
    • Start the vCenter Single Sign On service
    • Start the VMware vCenter Inventory service
    • Start the VMware VirtualCenter Server service and the VMware VirtualCenter Management WebServices servic
    • Start the VMware vSphere Web Client service.
    • Start the VMware Log Browser service.
      
18. Wait 5 minutes for the services to start completely.
19. Log in and check that the Log Browser is functioning correctly.
    
    Note: If the service is not fully started, you will not see the option for the Log browser. Log out and log back in after a few minutes. It is available after it has completely loaded.