VirtualCenter Custom SSL Certificate

To configure custom SSL certificates in VirtualCenter 2.5:

1. Download and install openssl for Windows.
   Note: This article assumes you run all commands fromc:\openssl\bin.
2. Create a VirtualCenter server private key (rui.key):

   openssl genrsa 1024 > rui.key
   

   Note: Value cannot be larger than 1024 for VirtualCenter 2.x families.

3. Create a certificate signing request (rui.csr):

   openssl req -new -key rui.key > rui.csr -config openssl.cfg
   

   Note: When prompted for common name, fill in the hostname of the VirtualCenter server.

4. Send therui.csrto certificate authority (CA) server.
5. Browse toc:\openssl\bin, and save the file/certificate from the certificate authority server asrui.crt.
6. Merge the server private key and the signed certificate into the pfx file (rui.pfx)by running the command:

   openssl pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx
   

   Note: You must enter a password to continue. The-passoutparameter can be omitted, but the user is prompted to enter a password twice.

7. Replace the Certificates on VirtualCenter Server
   1. Backup the existing files,rui.key,rui.crt, andrui.pfx, fromC:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\to a backup folder.
   2. Copy the custom files,rui.key,rui.crt, andrui.pfx, toC:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\
8. Stop VirtualCenter Server service using the command:

   net stop vpxd
   

9. Reset your database password. The purpose of this is that you need to encrypt the database password with the new keys.
   1. Browse to the root directory, located by default at C:\Program Files\VMware\Infrastructure\VirtualCenter Server, of your VirtualCenter Server install, then run:

      vpxd.exe –p
      

   2. When asked for your new password, enter your existing database password.
   3. When asked to confirm your password, enter the existing password again.
10. Start the VirtualCenter Server service with the command:

    net start vpxd
    

11. Install the root CA certificate into the trusted root CAs on the VirtualCenter server
    Follow the Pre-Trusting Certificatessection from "Enabling Server-Certificate Verification for Virtual Center Clients" (4646606).
12. Enable SSL in the registry:
    Follow the Enabling Server-Certificate Verificationsection from "Enabling Server-Certificate Verification for Virtual Center Clients" (4646606).
13. Log into your VirtualCenter Server using the VI Client. You must do this from the VirtualCenter machine.
14. A dialog with a certificate error appears. ClickIgnore.
15. Log into your VirtualCenter server using a VI Client from another workstation, not VirtualCenter Server. You are prompted to install the certificate on the workstation, clickYesorOK. Logout and log back in.