Installation guide

6 Select Export the current certificate to a .pfx file and click Next.
7 Specify a filename for the certificate file and click Next.
8 Type and confirm a password to be used to encrypt the information you want to export and click Next.
The system displays summary information about the certificate you are about export.
9 Verify the summary information and click Next > Finish.
What to do next
Configure your View Connection Server instance, security server, or View Transfer Server instance to use the
certificate. See “Configure a View Connection Server Instance or Security Server to Use a New Certificate,” on
page 80 or “Configure a View Transfer Server Instance to Use a New Certificate,” on page 81.
Creating a New SSL Certificate
You can create a new certificate to replace the default server SSL certificate provided with View Connection
Server. When you create a new certificate, you must decide whether it should be self-signed or signed by a
CA.
Because self-signed certificates are not officially registered with a trusted CA, they are not guaranteed to be
authentic. While adequate for data encryption between server and client, self-signed certificates do not provide
reliable information about the location of the software application or the corporate entity responsible for its
administration.
A CA is a trusted third party that guarantees the identity of the certificate and its creator. When a certificate is
signed by a trusted CA, users no longer receive messages asking them to verify the certificate, and thin client
devices can connect without requiring additional configuration. If your clients need to determine the origin
and integrity of the data they receive, you should obtain a CA-signed certificate.
1 Generate a Keystore and Certificate on page 77
Whether you plan to use a self-signed certificate, or to obtain a signed certificate from a CA, you must
use keytool to generate a keystore file and a self-signed certificate.
2 Obtain a Signed Certificate from a CA on page 78
To obtain a signed certificate from a CA, you must create a CSR. For testing purposes, you can obtain a
free temporary certificate based on an untrusted root from Thawte, VeriSign, or GlobalSign.
3 Convert a PKCS#12 Certificate to PKCS#7 Format on page 79
If you obtained a certificate in PKCS#12 format, you must convert it to PKCS#7 format before importing
it into your keystore file.
4 Import a Signed Certificate into a Keystore File on page 79
If you obtained a signed certificate from a CA, or if you exported an existing Microsoft IIS SSL server
certificate, use keytool to import the certificate into your keystore file.
Generate a Keystore and Certificate
Whether you plan to use a self-signed certificate, or to obtain a signed certificate from a CA, you must use
keytool to generate a keystore file and a self-signed certificate.
When you initially create a keystore file, the first certificate in the keystore file is a self-signed certificate. Later,
if you obtain a signed certificate from a CA, you import the response from the CA into the keystore file and
the self-signed certificate is replaced.
Prerequisites
Add keytool to the system path on your host. See “Add keytool and openssl to the System Path,” on
page 76.
Chapter 7 Configuring Certificate Authentication
VMware, Inc. 77