vCloud Director 8: Replace certificates

I currently have some self signed certificates on my vCloud Director 8 installation and want to update them with new certificates.  Here are the simplified steps to get this accomplished:

Firstly you need to create 2 certificates for each member of the group (cell) and import the certificates into host keystores.  Each vCD has 2 IP address which allows support for 2 different SSL endpoints(http and consoleproxy).  Each endpoint requires its own SSL certificate.

Requirements for cert include an X.500 distinguished name, while Subject Alternative Name is not necessary.

Replace certificate using vCD configuration script:
this process will also validate the db connection and prompt for SSL certificate and skips all other.

  1. SSH to vCD cell
  2. Stop the vCD services
    1. service vmware-vcd stop
  3. Run the configuration
    1. /opt/vmware/vcloud-director/bin/configure
    2. Specify full path to java keystore that holds the new certificates
    3. Provide keystore and certificate password
This will replace the certificates and restart the vCD services.
Certificates command of the cell management tool automates process replace certificates in JCEKS keystore.
  1. # cd /opt/vmware/vcloud-director/bin
  2. # ./cell-management-tool certificates -j -k /tmp/.ks -w kspw
  3. Restart the cell for changes to take affect.
    1. # service vmware-vcd restart

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s