6.0.3

Changing certool Configuration
When you run certool --gencert and certain other certicate initialization or management commands, the
CLI reads all the values from a conguration le. You can edit the existing le, override the default
conguration le (certool.cfg) by using the -–config=<file name> option, or override dierent values on
the command line.
The conguration le has several elds with the following default values:
Country = US
Name= Acme
Organization = AcmeOrg
OrgUnit = AcmeOrg Engineering
State = California
Locality = Palo Alto
IPAddress = 127.0.0.1
Email = [e-mail]
Hostname = server.acme.com
You can change the values in the conguration as follows:
n
Create a backup of the conguration le and then edit the le. If you are using the default conguration
le, you do not have to specify it. Otherwise, for example, if you changed the conguration le name,
use the --config command-line option.
n
Override the conguration le value on the command line. For example, to override Locality, run this
command:
certool -–gencert -–privkey=private.key –-Locality="Mountain View"
Specify --Name to replace the CN eld of the Subject name of the certicate.
n
For solution user certicates, the name is <sol_user name>@<domain> by convention, but you can
change the name if a dierent convention is used in your environment.
n
For machine SSL certicates, the FQDN of the machine is used because the SSL client checks the CN
eld of the Subject name of the certicate when verifying the machine's host name. Because a machine
can have more than one alias, certicates have the Subject Alternative Name eld extension where you
can specify other names (DNS names, IP addresses, and so on). However, VMCA allows only one
DNSName (in the Hostname eld) and no other Alias options. If the IP address is specied by the user, it
is stored in SubAltName as well.
The --Hostname parameter is used to specify the DNSName of certicate's SubAltName.
certool Initialization Commands Reference
The certool initialization commands allow you to generate certicate signing requests, view and generate
certicates and keys that are signed by VMCA, import root certicates, and perform other certicate
management operations.
In many cases, you pass a conguration le in to a certool command. See “Changing certool Conguration,”
on page 120. See “Replace Existing VMCA-Signed Certicates With New VMCA-Signed Certicates,” on
page 92 for some usage examples.
certool --initcsr
Generates a Certicate Signing Request (CSR). The command generates a PKCS10 le and a private key.
vSphere Security
120 VMware, Inc.