5.5

10 When you receive the signed certificates, import them into the keystore file.
a Import the Certification Authority's root certificate into the keystore file.
This command imports the root certificate from the root.cer file to the certificates.ks keystore
file.
keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -import -alias root
-file root.cer
b (Optional) If you received intermediate certificates, import them into the keystore file.
This command imports intermediate certificates from the intermediate.cer file to the
certificates.ks keystore file.
keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -import -alias
intermediate -file intermediate.cer
c Import the certificate for the HTTP service.
This command imports the certificate from the http.cer file to the certificates.ks keystore file.
keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -import -alias http
-file http.cer
d Import the certificate for the console proxy service.
This command imports the certificate from the consoleproxy.cer file to the certificates.ks
keystore file.
keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -import -alias
consoleproxy -file consoleproxy.cer
11 To verify that all the certificates are imported, list the contents of the keystore file.
keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -list
12 Repeat steps Step 1 through Step 11 on each of the remaining vCloud Director servers.
What to do next
If you created the certificates.ks keystore file on a computer other than the server on which you
generated the list of fully qualified domain names and their associated IP addresses, copy the keystore file to
that server now. You will need the keystore path name when you run the configuration script. See
“Configure Network and Database Connections,” on page 26.
NOTE Because the vCloud Director configuration script does not run with a privileged identity, the keystore
file and the directory in which it is stored must be readable by any user.
Create a Self-Signed SSL Certificate
Self-signed certificates can provide a convenient way to configure SSL for vCloud Director in environments
where trust concerns are minimal.
Each vCloud Director server requires two SSL certificates, one for each of its IP addresses, in a Java keystore
file. You must create two SSL certificates for each server that you intend to use in your vCloud Director
server group. You can use certificates signed by a trusted certification authority, or self-signed certificates.
Signed certificates provide the highest level of trust.
To create and import signed certificates, see “Create and Import a Signed SSL Certificate,” on page 17.
Prerequisites
n
Generate a list of fully-qualified domain names and their associated IP addresses on this server, along
with a service choice for each IP address. See “Create SSL Certificates,” on page 17.
Chapter 1 Overview of vCloud Director Installation, Configuration, and Upgrade
VMware, Inc. 19