4.2.1

n
Obtain a Server Certificate Signed by a Certificate Authority on page 51
To provide recipients with an acceptable level of trust that the package was created by your server,
certificates are typically signed by a certificate authority (CA). Certificate authorities guarantee that you
are who you claim to be, and as a token of their verification, they sign your certificate with their own.
n
Import a Server Certificate on page 52
You can import a server certificate and use it with Orchestrator.
n
Export a Server Certificate on page 52
The server certificate private key is stored in the vmo_keystore table of the Orchestrator database. In case
you lose or delete this key, or if you bind the Orchestrator server to a different database, the contents of
the exported packages signed with this certificate become unavailable. To ensure that packages are
decrypted on import, you must save this key to a local file.
n
Changing a Self-Signed Server Certificate on page 53
If you want to sign your packages with a server certificate different from the one you used for the initial
Orchestrator configuration, you must export all your packages and change the Orchestrator database.
Create a Self-Signed Server Certificate
Installing Orchestrator or deploying the Orchestrator requires that you create a certificate. You can create a
self-signed certificate to guarantee encrypted communication and a signature for your packages. However,
the recipient cannot be sure that the self-signed package that you are sending is in fact a package issued by
your server and not a third party claiming to be you.
Procedure
1 Log in to the Orchestrator configuration interface as vmware.
2 Click Server Certificate.
3 Click Create certificate database and self-signed server certificate.
4 Type the relevant information.
5 From the drop-down menu, select a country.
6 Click Create.
Orchestrator generates a server certificate that is unique to your environment. The details about the certificate's
public key appear in the Server Certificate window. The certificate's private key is stored in the
vmo_keystore table of the Orchestrator database.
What to do next
For disaster recovery purposes, you can save the certificate private key to a local file.
Obtain a Server Certificate Signed by a Certificate Authority
To provide recipients with an acceptable level of trust that the package was created by your server, certificates
are typically signed by a certificate authority (CA). Certificate authorities guarantee that you are who you claim
to be, and as a token of their verification, they sign your certificate with their own.
Procedure
1 Log in to the Orchestrator configuration interface as vmware.
2 Click Server Certificate.
Chapter 5 Initial Configuration of the Orchestrator Server
VMware, Inc. 51