5.5

Install a Certificate from a Certificate Authority
To install a signed certificate from a Certificate Authority you must obtain an SSL certificate from a CA and
import it in your local keystore.
Prerequisites
Generate a new SSL certificate.
Procedure
1 Create a certificate signing request by running the following command in the Java utility.
keytool -certreq -dunes -keypass "dunesdunes" -keystore
"install_directory\app-server\conf\security\jssecacerts" -storepass
"dunesdunes" -file certreq.csr
The utility generates a file called certreq.csr.
2 (Optional) Submit the certreq.csr file to a certificate authority, such as VeriSign or Thawte.
Procedures might vary from one CA to another, but they all require a valid proof of your identity.
The CA returns a certificate that you must import.
3 Import the SSL certificate into your local keystore.
a Download a root certificate from the CA that signed your certificate.
b Import the root certificate in your keystore by running the following command in the Java utility.
keytool -import -alias root -keystore
"install_directory\app-server\conf\security\jssecacerts" \
-trustcacerts -file <filename_of_the_root_certificate>
c Import the SSL certificate signed by the CA (the SSL certificate must be in X509 DER format).
keytool -importcert -alias dunes -keypass "dunedunes" -file
vcoCertificate.crt -keystore
"install_directory\app-server\conf\security\jssecacerts" -storepass "dunesdunes"
The SSL certificate is installed. You can change the Web views SSL certificate, the SSL certificate for the
Orchestrator configuration interface, or the SSL certificate for the Orchestrator client.
Adding the Certificate to the Local Store
After you get a certificate from a CA or create a certificate that matches your Orchestrator server name, you
must add the certificate to your local store so that you can work with the Orchestrator configuration
interface or Web views without receiving certificate warnings or error messages.
This workflow describes the process to add the certificate to your local store in Internet Explorer.
1 Open your Internet Explorer and navigate to https://orchestrator_server_IP_or_DNS_name:8283/.
2 When prompted, click Continue to this website (not recommended).
In Internet Explorer you see the Certificate Error on the right within the address bar.
3 Click the Certificate Error and select View Certificates.
4 Click Install Certificate.
5 On the Welcome page of the Certificate Import Wizard, click Next.
6 In the Certificate Store window, select Place all certificates in the following store.
Installing and Configuring VMware vCenter Orchestrator
102 VMware, Inc.