After a lot of struggling in the past I finally found a dummy proof way to replace the vRealize Orchestrator (vRO) appliance certificate that works every time. The official documentation for replacing the certificate of the vRO appliance with a CA signed certificate is not so clear, so I hope this helps a bit.
Lets get started!
To create the certificate request first download OpenSSL for Windows and install it in the default location : C:\OpenSSL-Win64
After OpenSSL is installed create the certificate configuration file : C:\OpenSSL-Win64\Certs\rui.cfg and add the following information. Change the marked values starting and ending with % to your own specification.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
[ req ] default_bits = 2048 default_keyfile = rui.key distinguished_name = req_distinguished_name encrypt_key = no prompt = no string_mask = nombstr req_extensions = v3_req [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth subjectAltName = IP:%IP%, DNS:%FQDN%, DNS:%HOSTNAME%, [ req_distinguished_name ] countryName = %countryName% stateOrProvinceName = %stateOrProvinceName% localityName = %localityName% 0.organizationName = %organizationName% organizationalUnitName = %organizationalUnitName% commonName = %commonname% |
Next we need to create the PFX file that we are going to import in vRO.
Open a command prompt and run the following commands :
|
1 2 3 |
mkdir C:\OpenSSL-Win64\Certs C:\OpenSSL-Win64\bin\openssl req -new -nodes -out C:\OpenSSL-Win64\Certs\rui.csr -keyout C:\OpenSSL-Win64\Certs\rui-orig.key -config C:\OpenSSL-Win64\Certs\rui.cfg C:\OpenSSL-Win64\bin\openssl rsa -in C:\OpenSSL-Win64\Certs\rui-orig.key -out C:\OpenSSL-Win64\Certs\rui.key |
Now we can submit the Certificate Request to the Certificate Authority (CA).
Save the generated certificate as a base64 file : C:\OpenSSL-Win64\Certs\rui.cer
Save the CA certificate as a base64 file : C:\OpenSSL-Win64\Certs\ca.cer
Save the optional Intermediate CA certificate as a base64 file : C:\OpenSSL-Win64\Certs\intca.cer
Then run the following command :
|
1 2 |
C:\OpenSSL-Win64\bin\type C:\OpenSSL-Win64\Certs\intca.cer C:\OpenSSL-Win64\Certs\ca.cer > C:\OpenSSL-Win64\Certs\chain.pem C:\OpenSSL-Win64\bin\openssl pkcs12 -export -out C:\OpenSSL-Win64\Certs\rui.pfx -inkey C:\OpenSSL-Win64\Certs\rui.key -in C:\OpenSSL-Win64\Certs\rui.cer -certfile C:\OpenSSL-Win64\Certs\chain.pem |
Note : Be sure to use the passphrase “dunesdunes” or change the passphrase in the examples below!
Now upload your brand spanking new PFX file called C:\OpenSSL-Win64\Certs\rui.pfx to the vRO appliance in the folder /tmp.
SSH with your favourite SSH client to the vRO appliance and run the following commands :
|
1 2 3 4 5 |
service vco-server stop cd /tmp keytool -delete -alias dunes -keystore /etc/vco/app-server/security/jssecacerts -storepass dunesdunes keytool -importkeystore -srckeystore rui.pfx -srcstoretype pkcs12 -srcstorepass dunesdunes -deststoretype jks -destkeystore /etc/vco/app-server/security/jssecacerts -deststorepass dunesdunes keytool -list -keystore /etc/vco/app-server/security/jssecacerts -storetype jks -storepass dunesdunes |
A list of certificates is shown, replace “1” in the command below with the alias from the list of certificates containing the “PrivateKeyEntry” entry.
|
1 2 |
keytool -changealias -alias "1" -destalias "dunes" -keystore /etc/vco/app-server/security/jssecacerts -storetype jks -storepass dunesdunes reboot |
After your vRO appliance has been rebooted open your browser and point it to https://%fqdn%:8281 an voila no more certificate warnings.
But even after you replaced the certificate on the vRO appliance and you log in through the vRO client a warning still appears.
The reason for this is that the vRO client uses a local keystore which doesn’t know / trusts the new CA signed certificate.
You can fix this by logging onto the client and stop the Orchestrator client.
Back up the jssecacerts file, located at :
C:\Program Files\VMware\Orchestrator\jre\bin\jre\lib\security\jssecacerts
Now you have to create a new chain that includes the client, CA and possible CA Intermediate certificates. Go to the server where the base64 certificates are located from the previous steps, open a command prompt and run these commands.
|
1 |
type C:\OpenSSL-Win64\Certs\rui.cer C:\OpenSSL-Win64\Certs\intca.cer C:\OpenSSL-Win64\Certs\ca.cer > C:\OpenSSL-Win64\Certs\clientchain.pem |
Copy the clientchain.pem file to the machine where you have the vRO client installed in the folder C:\Program Files\VMware\Orchestrator\jre\bin. Now on the machine with the vRO client open a command prompt and run these commands to add the certificate to the local keystore :
|
1 2 |
cd "C:\Program Files\VMware\Orchestrator\jre\bin" keytool -importcert -noprompt -keystore ..\lib\security\jssecacerts -storepass dunesdunes -alias ourOwnCARootV1 -file clientchain.pem |
Happy developing 🙂 !
Many thanks to Sky Cooper for his excellent post about importing the PFX file in vRO.
