vCloud Director 8: Replace certificates

I currently have some self signed certificates on my vCloud Director 8 installation and want to update them with new certificates.  Here are the simplified steps to get this accomplished:

Firstly you need to create 2 certificates for each member of the group (cell) and import the certificates into host keystores.  Each vCD has 2 IP address which allows support for 2 different SSL endpoints(http and consoleproxy).  Each endpoint requires its own SSL certificate.

Requirements for cert include an X.500 distinguished name, while Subject Alternative Name is not necessary.

Replace certificate using vCD configuration script:
this process will also validate the db connection and prompt for SSL certificate and skips all other.

  1. SSH to vCD cell
  2. Stop the vCD services
    1. service vmware-vcd stop
  3. Run the configuration
    1. /opt/vmware/vcloud-director/bin/configure
    2. Specify full path to java keystore that holds the new certificates
    3. Provide keystore and certificate password
This will replace the certificates and restart the vCD services.
Certificates command of the cell management tool automates process replace certificates in JCEKS keystore.
  1. # cd /opt/vmware/vcloud-director/bin
  2. # ./cell-management-tool certificates -j -p -k /tmp/.ks -w kspw
  3. Restart the cell for changes to take affect.
    1. # service vmware-vcd restart

One thought on “vCloud Director 8: Replace certificates

  1. might want to add a -p to handle the console proxy as well.

    /opt/vmware/vcloud-director/bin/cell-management-tool certificates -j -p -k /tmp/.ks -w kspw


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s