This article provides instructions for using OpenSSL to configure an authentication certificate for use with VMware Aria Operations (formerly known as vRealize Operations).

VMware vRealize Operations 8.x
VMware vRealize Operations 8.5.x
VMware vRealize Operations Manager 6.7.x
VMware Aria Operations 8.12.x
VMware vRealize Operations 8.1.x
VMware vRealize Operations Manager 7.5.x
VMware vRealize Operations Manager 6.6.x
VMware vRealize Operations 8.0.x
VMware vRealize Operations 8.6.x
VMware vRealize Operations 8.4.x
VMware vRealize Operations 8.3.x
VMware vRealize Operations Manager 7.0.x
VMware vRealize Operations 8.10.x
VMware vRealize Operations 8.2.x

1. Generate a new Certificate PEM for VMware Aria Operations.
2. Install the Certificate PEM in the VMware Aria Operations Admin UI.

Generate a new Certificate PEM file  

 

1. Log into the Primary node as root via SSH or Console.
2. Run the following command to make the /cert directory, then change to that directory:

3. In the /cert directory, create a new file called vrops.cnf:

4. The contents of the file should be as follows for a 3 node cluster:

• The CN is required to be listed in the subjectAltName section for web browser compatibility.
• If using a load balancer, the CN should be the IP/FQDN of the load balancer. 
• The certificate will be valid for any FQDN/IP that is added to subjectAltName section.  Follow your company's security policy for the SAN field, but it is advised to include the IP addresses or FQDN's for each node in the cluster.

5. In the example above, replace the following with values relevant to your environment.  Remove or add nodes relevant to your environment:

• Primary_Node_FQDN
• Primary_Node_FQDN
• Node_2_FQDN
• Node_3_FQDN
• Primary_Node_Shortname
• Node_2_Shortname
• Node_3_Shortname
• Primary_Node_IP
• Node_2_IP
• Node_3_IP

6. Save and close the file:

7. Using the aops.cnf file, run the following command to create the CSR to send to your Certificate Authority:

8. Run the following to verify the information in the CSR is correct:

If all information is correct, send the CSR (aops.csr) to your Certificate Authority and inform them of the details you have configured in the subjectAltName line of aops.cnf.

Once the Certificate Authority signs your CSR, they will return to you the signed cert based on this CSR and also their own root cert (along with any intermediate certs). Ensure that you download them in Base64 format if given an option.

9. To construct the PEM file to upload to VMware Aria Operations, you need to combine these files in a specific order:

• The signed cert returned to you by the CA, based on the CSR you created.
• The private key you generated earlier (aops.key in above example).
• Intermediate certs returned by CA (only if applicable)
• The CA's root cert

10. Add the files downloaded form your CA to the VMware Aria Operations Primary node's /cert directory using an SCP utility.
11. Log into the Primary node as root via SSH or Console, pressing ALT+F1 in a Console to log in.
12. To combine these files, run the cat command as follows (Replacing the filenames as necessary):

Note: If you have trouble applying the newly created certificate in VMware Aria Operations, see the Troubleshooting PEM file issues section of this article.  You can also see Using the Custom Certificate Tool in VMware Aria Operations to help troubleshoot the certificate.

 

Install a New Certificate in VMware Aria Operations   

1. In a Web browser, navigate to the VMware Aria Operations administration interface at https://aops-node-FQDN-or-ip-address/admin.
2. Log in with the local admin username and password.
3. If you are on Aria Operations 8.10 or later, click Take Offline under Cluster Status.

4. At the upper right, click the yellow SSL Certificate icon.
5. In the SSL Certificate window, click Install New Certificate.
6. Click Browse for certificate.
7. Locate the certificate .pem file, and click Open to load the file in the Certificate Information text box.

8. Click Install.
9. If you are on Aria Operations 8.10 or later, once the certificate is installed, click Bring Online under Cluster Status.

 

Troubleshooting PEM file issues:

• If issues are encountered applying the new certificate, the VMware Aria Operations Custom Certificate Tool can be utilized to help determine the issue: How to use the VMware Aria Operations Custom Certificate Tool (2135521)
• If an invalid certificate has been applied and functionality of VMware Aria Operations has been impacted, you can revert to the default certificate to keep the cluster functional while troubleshooting of the new certificate is ongoing: Reload the default certificate in VMware Aria Operations (2105229)
• To decode each entry of the PEM file, using one of the following links:
  • https://certlogik.com/decoder/
  • https://www.sslshopper.com/certificate-decoder.html
  • https://redkestrel.co.uk/products/decoder/

Disclaimer: VMware Global Support does not assist in creating custom certificates for use in VMware Aria Operations.  For additional support in creating a custom certificate for use in VMware Aria Operations, contact VMware Professional Services.

For steps on how to configure a certificate for use with VMware Aria Operations Cloud Proxy, see Configure a Certificate For Use With VMware Aria Operations Cloud Proxy (89583).

For more information see:

• vApp Deployment and Configuration Guide
• Generating certificates for use with the VMware SSL Certificate Automation Tool (2044696)

For Translated versions of this article, see:

• 配置用于 vRealize Operations 的证书

• vRealize Operations Manager で使用する証明書の構成

Impact/Risks:
Attempting to apply an invalid certificate may result in any of the following:

• VMware Aria Operations certificate wizard shows the certificate as valid but does not accept the certificate.
• The default certificate is still shown after applying the new certificate.
• You do not see any errors in the VMware Aria Operations UI.
• You are unable to log into the VMware Aria Operations UI or Admin UI after applying the new certificate.

The finished PEM file should look similar to the following example, where the number of CERTIFICATE sections depends on the length of the issuing chain:

-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
(Your Private Key: your_domain_name.key)
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate: DigiCertCA.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Root certificate: TrustedRoot.crt)
-----END CERTIFICATE-----

Failure to comply with the above format may result in the cluster being affected or even harmed.
Note: In pre 8.1 versions of vRealize Operations, the broken certs may not be detected by the Admin UI.