5.1

Changing SSL Certificates
By default, the Orchestrator server uses a self-signed SSL certificate to communicate remotely with the
Orchestrator client. Orchestrator also provides an SSL certificate that controls user access to Web views. You
can change the SSL certificates, for example if your company security policy requires you to use its SSL
certificates.
Generate a New Certificate
To change an SSL certificate, you can generate a new certificate. You can generate the new certificate on the
same computer on which Orchestrator is installed or on another computer.
Prerequisites
To generate the new certificate, you must use the Java keytool utility. You can find the utility on the system
on which Orchestrator is installed.
Procedure
1 Navigate to the keytool utility at the command prompt.
Option Action
If you installed the standalone
version of Orchestrator
Go to install_directory \VMware\Orchestrator\jre\bin\keytool.
If the vCenter Server installed
Orchestrator
Go to
install_directory \VMware\Infrastructure\Orchestrator\jre\bi
n\keytool.
2 Create a local certificate.
keytool -genkey -alias mySslCertificate -keyalg RSA -keystore <your_keystore_filename> \
-keysize 2048 -sigalg SHA512withRSA
The keytool utility generates a file called <your_keystore_filename> by using the information and
password that you provide when you run the command.
What to do next
You can create a signing request and submit the certificate to a Certificate Authority. You can then import the
signed certificate into your local keystore.
You can also change the Web views SSL certificate, the SSL certificate for the Orchestrator configuration
interface, or the SSL certificate for the Orchestrator client with the certificate you generated.
Install a Certificate from a Certificate Authority
To install a certificate signed from a Certificate Authority you must obtain an SSL certificate from a CA and
import it in your local keystore.
Prerequisites
Make sure that you have generated a new SSL certificate.
Procedure
1 (Optional) Create a certificate signing request by running the following command in the Java utility.
keytool -certreq -alias mySslCertificate -file certreq.csr \
-keystore <your_keystore_filename>
The utility generates a file called certreq.csr.
Chapter 7 Configuration Use Cases and Troubleshooting
VMware, Inc. 75