September 2015 – vMBaggum

How to replace the vRealize Orchestrator appliance certificate

September 29, 2015September 30, 2015 Marco van Baggum Leave a comment

After a lot of struggling in the past I finally found a dummy proof way to replace the vRealize Orchestrator (vRO) appliance certificate that works every time. The official documentation for replacing the certificate of the vRO appliance with a CA signed certificate is not so clear, so I hope this helps a bit.

Lets get started!

To create the certificate request first download OpenSSL for Windows and install it in the default location : C:\OpenSSL-Win64

After OpenSSL is installed create the certificate configuration file : C:\OpenSSL-Win64\Certs\rui.cfg and add the following information. Change the marked values starting and ending with % to your own specification.

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = IP:%IP%, DNS:%FQDN%, DNS:%HOSTNAME%, 

[ req_distinguished_name ]
countryName = %countryName%
stateOrProvinceName = %stateOrProvinceName%
localityName = %localityName%
0.organizationName = %organizationName%
organizationalUnitName = %organizationalUnitName%
commonName = %commonname%

[ req ]

default_bits = 2048

default_keyfile = rui.key

distinguished_name = req_distinguished_name

encrypt_key = no

prompt = no

string_mask = nombstr

req_extensions = v3_req

[ v3_req ]

basicConstraints = CA:FALSE

keyUsage = digitalSignature, keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth, clientAuth

subjectAltName = IP:%IP%, DNS:%FQDN%, DNS:%HOSTNAME%,

[ req_distinguished_name ]

countryName = %countryName%

stateOrProvinceName = %stateOrProvinceName%

localityName = %localityName%

0.organizationName = %organizationName%

organizationalUnitName = %organizationalUnitName%

commonName = %commonname%

Next we need to create the PFX file that we are going to import in vRO.
Read More

vRealize Orchestrator ERR_SSL_WEAK_EPHEMERAL_DH_KEY error

September 8, 2015September 8, 2015 Marco van Baggum 2 Comments

Yesterday while validating a vRealize Orchestrator (vRO) deployment on a PSO engagement with my colleague Matthew Bunce (link), we got this weird error when we tried to open the configuration page of a vRO appliance :

So what has changed? Why didn’t we got this error before?
Ah of course Chrome has been updated (version 45)! And not only does this issue appear on Chrome but the problem seems to occur on the updated Firefox (version 40).

Fix the vRealize Orchestrator ERR_SSL_WEAK_EPHEMERAL_DH_KEY error

After some Google magic I came across a VMware KB (link) which pointed me in the right direction.

Open an SSH connection to the vRO appliance, and edit the file /etc/vco/app-server/server.xml
Search for the line :

ciphers="TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA"

1	ciphers="TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA"

And replace it with :

ciphers="TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA"

1	ciphers="TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA"

And do the same in the file /var/lib/vco/configuration/conf/server.xml

And finally reboot the appliance (just to be sure…)

Enjoy! 🙂

UPDATE

John Milner (link) pointed out to me in his comment below, that if you are using the Windows installation, you can follow the same procedure as above but then for the file : %INSTALL_PATH%\VMware\Orchestrator\app-server\conf\server.xml

Thanks John!

How to manually update the vRealize Business reference database

September 7, 2015September 7, 2015 Marco van Baggum Leave a comment

On several of my last vRealize projects, I’ve had the challenge (one of many 😉 ) of getting direct access from the vRealize Business (vRB) to the internet to retrieve the latest vRB reference database from the VMware servers. There is a manual way to do this, but this involves opening a SR, sending them the though vRB created file and waiting for VMware support to reply with the updated file. It works but it takes some time and effort also from VMware support.

But now VMware came up with an improved way to update the vRealize Business reference database : https://vrb-hub.vmware.com/manualupdate

Update vRealize Business reference database process

Open the vRealize Automation (vRA) portal and log in to the portal with credentials that has “Business Management Administrator” rights. Then open Business Administration -> Business Management -> Update Reference Database.
Read More