VMware vCenter Server 5.1.x
VMware vCenter Server 5.5.x

Creating CA signed certificates for vSphere is a complex task. Therefore, VMware has worked to simplify the process by creating a tool to help automate the process. Before you can run the tool, however, you must have correctly created certificates to be able to utilize the tool. This article provides the steps to create the appropriate certificates. The steps are:

• Generating Certificate Requests
• Obtain the certificates
• Create the PEM files

Remember that each component of the vCenter Server configuration requires its own certificate. Before attempting these steps, ensure that:

• You have a vSphere 5.1 or vSphere 5.5 environment.
• The environment has been pre-installed for all components for which you will be installing certificates.

Generating Certificate Requests

There are seven separate components in vCenter Server 5.1 and 5.5 that utilize certificates to encrypt communication. This article can be used if the components are on the same server and if they are on different servers, as long as you have a separate certificate for each component.

As of the SSL Certificate Automation tool version 1.0.1, the certificate requests can be created directly from the tool, automating many manual steps. For more details on manually creating the requests rather than generating them from the tool, see the Additional Information section of this article.

When creating the requests, the SSL Certificate Automation Tool ensures that by default the requests have the proper uniqueness. The requirements for the certificate requests are that they:

• Have the subject alternative name field included in them.
• Have unique Subject Distinguished Name (DN) for the certificate. The SSL Certificate Automation tool uses OrganizationalUnitNames for the components to achieve this uniqueness.
• Include digitalSignature, keyEncipherment, and dataEncipherment components for Key Usage.

To generate the certificate requests:

1. From a command line, navigate to the location where you unzipped the tool.
2. Run this command:
   
   ssl-updater.bat
   
    
3. From the SSL Certificate Automation tool, select Option 2 to Generate Certificate Requests.
4. 
   Note: VMware recommends that the certificate request (and consequently the private key) are generated on the system which is being used for the service.
    
5. Select the option for the service you are generating the certificate request for.
6. Enter the information requested for the certificate request. By default the SSL Certificate Automation tool automatically populates much of the information required. The following is a description of the information requested:
   1. DNS Name - the fully qualified domain name of the server. For example: server.domain.com
   2. IP address - the IP address of the server. For example: 10.0.0.10
   3. Short name - the short hostname of the server. For example: server
   4. Country - the two digit country code. For example: US
   5. State or Province - The state or province for the certificate. For example: California
   6. City or Locality - The city for the certificate. For example: Palo Alto
   7. Organization - The name of the organization for the certificate. For example: VMware
   8. Organizational Unit name - The organizational unit name for the certificate. By default VMware specifies a default value of and uses it to ensure that the DN of the certificate is unique. Do not change this unless there is another field which makes the DN of the certificate unique.
      
      Note: Unique DNs are a hard requirement for vSphere 5.1. vCenter Single Sign-On uses the certificates to ensure that communication details are secure.
       
   9. Enter the directory where the CSR will be saved. By default, the CSRs and KEYs are saved in the SSL-TOOL-DIRECTORY\Requests directory.
      
      Important: Ensure that the directory in which the SSL Certificate Automation Tool is extracted and the specified CSR directory above do not have spaces in the names or CSR Generation will fail.
       
   10. Repeat steps 2 and 3 for each service which you are generating a certificate for.

Obtaining the Certificate

After the certificate request is created, it must be given to the certificate authority for generation of the actual certificate. The authority presents a certificate back and a copy of their root certificate. For the certificate chain to be trusted, the root certificate must be installed on the server. Follow the appropriate section below for the steps for the certificate authority in question.

For Commercial CAs, to create each certificate request:

As of version 1.0.1 of the SSL Certificate Automation Tool, the certificate requests can be generated directly from the tool. If for some reason, you are not able to use the automated process in the tool, the manual steps can still be used as noted below.
 

Creating the OpenSSL configuration files manually

• Have the subject alternative name field included in them
• Have unique OrganizationalUnitNames for the components
• Include digitalSignature, keyEncipherment, and dataEncipherment components for Key Usage

On the system where you will be generating the certificates, create a folder in which you can store the certificates for the different components. These steps use the C:\certs folder as an example.

In the C:\certs folder, create seven other folders so that you can organize each of the certificates. These steps use these seven folders:

• InventoryService
• SSO
• vCenter
• WebClient
• LogBrowser
• UpdateManager
• Orchestrator

After this is done, create OpenSSL configuration files for each service. Here is an example of a completed configuration file:

Note: Each SSL Certificate requires a unique Distinguished Name (DN). The examples in this article use the OrganizationalUnitName (OU) field to achieve this uniqueness, based on a configuration where all components are installed on the same server. If the services are all on separate servers, they have a unique DN by default.

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:vc51-1, IP:10.0.0.10, DNS:vc51-1.vmware.com

[ req_distinguished_name ]
countryName = US
stateOrProvinceName = NY
localityName = New York
0.organizationName = VMWare
organizationalUnitName = vCenterInventoryService
commonName = vc51-1.vmware.com

Note: The country name is always the two digit country code for the country.

The procedure below provides detailed step-by-step instructions for the creation of each of the unique requests if you want to implement custom certificates for all components. They include the detailed changes which are required to be made in each certificate file to achieve the uniqueness required.

Note: At least one subjectAltName should be in place for each server that matches the commonName field. You do not need to include the IP address as a subjectAltName if policies prohibit the use of it, but this configuration is recommended by VMware.
 

1. For the Inventory Service, create a file in C:\certs\InventoryService called inventoryservice.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = vCenterInventoryService
commonName = server.domain.com
    
2. For vCenter Single Sign-On (SSO), create a file in C:\certs\SSO called sso.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = vCenterSSO
commonName = server.domain.com
    
3. For the VirtualCenter Server Service, create a file in C:\certs\vCenter called vcenter.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = vCenterServer
commonName = server.domain.com
    
4. For the vSphere Web Client, create a file in C:\certs\WebClient called webclient.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = vCenterWebClient
commonName = server.domain.com
    
5. For the VMware Log Browser, create a file in C:\certs\LogBrowser called LogBrowser.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = vCenterLogBrowser
commonName = server.domain.com
    
6. For vSphere Update Manager, create a file in C:\certs\UpdateManager called UpdateManager.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = VMwareUpdateManager
commonName = server.domain.com
    
7. For vRealize Orchestrator, create a file in C:\certs\Orchestrator called Orchestrator.cfg. Paste this text into the file, changing the elements in Red:
   
   [ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:ServerShortName, IP:ServerIPAddress, DNS:server.domain.com

[ req_distinguished_name ]
countryName = Country
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = VMwareOrchestrator
commonName = server.domain.com

After completing this section, the OpenSSL configuration files are configured. Proceed to the Generating certificate requests section of this article.
 

Generating certificate requests manually

Once OpenSSL has been configured, you must generate a certificate request for each of the components.

To generate the certificate requests:

1. Launch a command prompt and navigate to the OpenSSL directory. By default, this is C:\OpenSSL-Win32\bin.
2. Run this command to create the Inventory Service certificate request and export the private key:
   
   openssl req -new -nodes -out c:\certs\InventoryService\rui.csr -keyout c:\certs\InventoryService\rui-orig.key -config c:\certs\InventoryService\inventoryservice.cfg
    
3. Convert the key to be in the proper RSA format for the Inventory Service to use:
   
   openssl rsa -in c:\certs\InventoryService\rui-orig.key -out c:\certs\InventoryService\rui.key
    
4. Run this command to create the vCenter SSO certificate request and export the private key:
   
   openssl req -new -nodes -out c:\certs\sso\rui.csr -keyout c:\certs\sso\rui-orig.key -config c:\certs\sso\sso.cfg
    
5. Convert the key to be in the proper RSA format for vCenter Server SSO to use:
   
   openssl rsa -in c:\certs\sso\rui-orig.key -out c:\certs\sso\rui.key
    
6. Run this command to create the vCenter Server Service certificate request and export the private key:
   
   openssl req -new -nodes -out c:\certs\vCenter\rui.csr -keyout c:\certs\vCenter\rui-orig.key -config c:\certs\vCenter\vcenter.cfg
    
7. Convert the key to be in the proper RSA format for vCenter Server to use:
   
   openssl rsa -in c:\certs\vCenter\rui-orig.key -out c:\certs\vCenter\rui.key
    
8. Run this command to create the vSphere Web Client certificate request and export the private key:
   
   openssl req -new -nodes -out c:\certs\WebClient\rui.csr -keyout c:\certs\WebClient\rui-orig.key -config c:\certs\WebClient\webclient.cfg
    
9. Convert the key to be in the proper RSA format for the vSphere Web Client to use:
   
   openssl rsa -in c:\certs\WebClient\rui-orig.key -out c:\certs\WebClient\rui.key
    
10. Run this command to create the vSphere Log Browser certificate request and export the private key:
    
    openssl req -new -nodes -out c:\certs\LogBrowser\rui.csr -keyout c:\certs\LogBrowser\rui-orig.key -config c:\certs\LogBrowser\logbrowser.cfg
     
11. Convert the key to be in the proper RSA format for the Log Browser to use:
    
    openssl rsa -in c:\certs\LogBrowser\rui-orig.key -out c:\certs\LogBrowser\rui.key
     
12. Run this command to create the vSphere Update Manager certificate request and export the private key:
    
    openssl req -new -nodes -out c:\certs\UpdateManager\rui.csr -keyout c:\certs\UpdateManager\rui-orig.key -config c:\certs\UpdateManager\updatemanager.cfg
     
13. Convert the key to be in the proper RSA format for vSphere Update Manager to use:
    
    openssl rsa -in c:\certs\UpdateManager\rui-orig.key -out c:\certs\UpdateManager\rui.key
     
14. Run this command to create the vRealize Orchestrator certificate request and export the private key:
    
    openssl req -new -nodes -out c:\certs\Orchestrator\rui.csr -keyout c:\certs\Orchestrator\rui-orig.key -config c:\certs\Orchestrator\Orchestrator.cfg
     
15. Convert the key to be in the proper RSA format for vRealize Orchestrator to use:
    
    openssl rsa -in c:\certs\Orchestrator\rui-orig.key -out c:\certs\Orchestrator\rui.key

After completing this section, you now have the rui.csr and rui.key files located in each of the respective directories for the different services. To validate that the CSR is created properly, you can run the command:

openssl req -in rui.csr -noout -text

After running the command, verify the output to ensure that all of the parameters entered in the .cfg file are properly set.

Proceed to the Obtaining the certificate section in the Resolution area of this article.
Deploying and using the SSL Certificate Automation Tool 1.0.x
Deploying and using the SSL Certificate Automation Tool 5.5
使用する証明書を VMware SSL Certificate Automation Tool で生成する
生成证书以与 VMware SSL 证书自动化工具结合使用