For a project I’m currently working on, we are designing a large vRealize Operations (vROps) cluster with Load Balancing and High Availability requirements. Because I wanted to test all the vROps Load Balancing and HA features myself, I needed to create a proper certificate before putting the vROps appliances behind a Load Balancer. This article describes the steps you will have to take to create a proper certificate.
To create the Certificate Request first download OpenSSL for Windows and install it in the default location : C:\OpenSSL-Win32
After OpenSSL is installed we can create the configuration file : C:\OpenSSL-Win32\Certs\vrops.cfg and add the following information. Change the marked values starting and ending with % to your own specification.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
[ req ] default_bits = 2048 default_keyfile = vrops.key distinguished_name = req_distinguished_name encrypt_key = no prompt = no string_mask = nombstr req_extensions = v3_req [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth subjectAltName = DNS:%LOADBALANCEFQDN%, IP:%LOADBALANCEIP%, DNS:%LOADBALANCESHORTNAME%, DNS:%FIRSTNODEFQDN%, IP:%FIRSTNODEIP%, DNS:%FIRSTNODESHORTNAME%, DNS:%SECONDNODEFQDN%, IP:%SECONDNODEIP%, DNS:%SECONDNODESHORTNAME% [ req_distinguished_name ] countryName = %countryName% stateOrProvinceName = %stateOrProvinceName% localityName = %localityName% 0.organizationName = %organizationName% organizationalUnitName = %organizationalUnitName% commonName = %LOADBALANCEFQDN% |
Then run the following commands
|
1 2 3 |
C:\OpenSSL-Win32\bin\openssl req -new -nodes -out C:\OpenSSL-Win32\Certs\vrops.csr -keyout C:\OpenSSL-Win32\Certs\vrops-orig.key -config C:\OpenSSL-Win32\Certs\vrops.cfg C:\OpenSSL-Win32\bin\openssl rsa -in C:\OpenSSL-Win32\Certs\vrops-orig.key -out C:\OpenSSL-Win32\Certs\vrops.key |
Now we can submit the Certificate Request to our Certificate Authority (CA).
And save the generated certificate as a base64 file : C:\OpenSSL-Win32\Certs\vrops.cer
We must also not forget to download the CA certificate including the Subordinate / Intermediate CA information as base64 file : C:\OpenSSL-Win32\Certs\ca.cer
After the download is complete we can create the required pem file for vROps. The pem file needs to looks like the following example :
—–BEGIN CERTIFICATE—–
[vrops.cer]
—–END CERTIFICATE—–
—–BEGIN RSA PRIVATE KEY—–
[vrops.key]
——END RSA PRIVATE KEY—–
—–BEGIN CERTIFICATE—–
[optional intermidate.cer]
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
[ca.cer]
—–END CERTIFICATE—–
You can do this by running the following commands :
|
1 2 |
cd C:\OpenSSL-Win32\Certs type vrops.cer vrops.key ca.cer > vrops.pem |
Now it is time to upload the pem file to the vROps appliances. This can be done by going to the admin page of the vROps appliance on https://MASTERNODEFQDN/admin and login. Click on the Certificate icon in the top right corner and select “Install New Certificate” and browse to the vrops.pem file.
Wait a couple of minutes, refresh the page and bingo a nice secure page without annoying warnings!
And after configuring the Load Balancer lets check if everything works as planned.
Load Balancer address :
First Node :
Second Node :
So cool 🙂
OpenSSL “unable to write ‘random state'” error
When I was in the process to create a key file I received numerous times the error “unable to write ‘random state'”
|
1 2 3 4 5 6 7 8 |
C:\OpenSSL-Win32\bin>openssl genrsa -out key_vrops.key 2048 Loading 'screen' into random state - done Generating RSA private key, 2048 bit long modulus ................................................................................ ...+++ ...+++ unable to write 'random state' e is 65537 (0x10001) |
Which can be easily solved by setting the RANDFILE variable in the DOS prompt.
|
1 2 3 4 5 6 7 |
C:\OpenSSL-Win32\bin>set RANDFILE=%USERPROFILE%\.rnd C:\OpenSSL-Win32\bin>openssl genrsa -out key_vrops.key 2048 Loading 'screen' into random state - done Generating RSA private key, 2048 bit long modulus ......................................................................+++ .....................................................................+++ e is 65537 (0x10001) |
This is very useful information….but I have a quick question, are certs needed for each node?
Hi,
Yes, it is advised to use CA signed certificates for all your nodes.
Marco
Marco thanks for the reply……I misread the post and thought you were applying the cert to the VIP name but now see are using the masternodes FQDN. So can you use the same cert on all the nodes (master, master-replica and data)? If not, why would you include them in the configuration file? Thanks again, thepusher
Hi,
Yes, you must use the same certificate on all nodes because you can only push the certificate to the cluster and not to a specific node.
Marco