5.5

11 Click Apply.
12 Build or update the database as necessary and click Apply changes.
You successfully configured Orchestrator to work with SQL Server Express by using Windows
authentication mode.
Server Certificate
The Package Signing Certificate is a form of digital identification that is used to guarantee encrypted
communication and a signature for your Orchestrator packages.
Issued for a particular server and containing information about the server’s public key, the certificate allows
you to sign all elements created in Orchestrator and guarantee authenticity. When the client receives an
element from your server, typically a package, the client verifies your identity and decides whether to trust
your signature.
IMPORTANT You cannot change the server certificate by using the Orchestrator configuration interface if
Orchestrator uses an embedded database. To change the server certificates without changing the database
settings, you must run the configuration workflows by using either the Orchestrator client or the REST API.
For more information about running the configuration workflows by using the Orchestrator client, see Using
the VMware vCenter Orchestrator Plug-Ins. For detailed instructions about running the configuration
workflows by using the REST API, see Chapter 7, “Configuring Orchestrator by Using the Configuration
Plug-In and the REST API,” on page 71.
n
Create a Self-Signed Server Certificate on page 55
Installing Orchestrator or deploying the Orchestrator requires that you create a certificate. You can
create a self-signed certificate to guarantee encrypted communication and a signature for your
packages. However, the recipient cannot be sure that the self-signed package that you are sending is in
fact a package issued by your server and not a third party claiming to be you.
n
Obtain a Server Certificate Signed by a Certificate Authority on page 55
To provide recipients with an acceptable level of trust that the package was created by your server,
certificates are typically signed by a certificate authority (CA). Certificate authorities guarantee that
you are who you claim to be, and as a token of their verification, they sign your certificate with their
own.
n
Import a Server Certificate on page 56
You can import a server certificate and use it with Orchestrator.
n
Export a Server Certificate on page 56
The server certificate private key is stored in the vmo_keystore table of the Orchestrator database. In
case you lose or delete this key, or if you bind the Orchestrator server to a different database, the
contents of the exported packages signed with this certificate become unavailable. To ensure that
packages are decrypted on import, you must save this key to a local file.
n
Changing a Self-Signed Server Certificate on page 56
If you want to sign your packages with a server certificate different from the one you used for the
initial Orchestrator configuration, you must export all your packages and change the Orchestrator
database.
Installing and Configuring VMware vCenter Orchestrator
54 VMware, Inc.