User`s guide

Prerequisites
n
Before placing the VCM Stunnel certificate and the VCM Stunnel private key, you must ensure the
files are secured according to your corporate best practices.
n
Verify that you have a [C:]\Program Files (x86)\VMware\VCM\Tools\sTunnel\certs\
directory. If the directory does not exist, create it.
n
Verify that you have a [C:]\Program Files (x86)\VMware\VCM\Tools\sTunnel\key\
directory. If the directory does not exist, create it.
Procedure
1. Place the VCM Stunnel certificate in
[C:]\Program Files (x86)\VMware\VCM\Tools\sTunnel\certs\vcm_stunnel_cert.pem.
2. Place the VCM Stunnel RSAprivate key in
[C:]\Program Files (x86)\VMware\VCM\Tools\sTunnel\key\vcm_stunnel_pk.pem.
3. Place the OS Provisioning Server Stunnel CA certificate validation chain in the file(s) and directory
specified in the stunnel.conf file.
The VCM Stunnel configuration file on the VCM application server is [C:]\Program Files
(x86)\VMware\VCM\Tools\stunnel.conf.
In Stunnel.conf, you should update the path for cert, key, CAfile or CApath, depending on
where you installed VCM.
cert = C:\Program Files (x86)\VMware\VCM\Tools\sTunnel\certs\vcm_stunnel_
cert.pem
key = C:\Program Files (x86)\VMware\VCM\Tools\sTunnel\key\vcm_stunnel_pk.pem
;; Use stunnel in client mode
client = yes
;; FIPS mode can be enabled as desired
fips = no
;; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;; Either CAfile or CAPath, but not both, should be defined
;; CAfile contains the certificate chains needed to verify the certificates of
remote connections
;CAfile = C:\Program Files (x86)\VMware\VCM\Tools\sTunnel\certs\ca-cert.pem
;; CApath = directory
;; Certificate Authority directory
;; This is the directory in which stunnel will look for certificates when
using the verify.
;; Note that the certificates in this directory should be named
;; XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of
the
Installing and Configuring the OS Provisioning Server and Components
VMware, Inc. 41