4.6

When you replace the default certificate with your own certificate, clients use your certificate to authenticate
the server. If your certificate is signed by a CA, the certificate for the CA itself is typically embedded in the
browser or is located in a trusted database that the client can access. After a client accepts the certificate, it
responds by sending a secret key, which is encrypted with the public key contained in the certificate. The secret
key is used to encrypt traffic between the client and the server.
You use the keytool and openssl utilities to create and manage certificates for View.
Add keytool and openssl to the System Path
keytool and openssl are key and certificate management utilities. You must add the paths to these utiilties to
the system environment Path variable so that you can run the utilities from any directory on your host.
Procedure
1 On your View Connection Server or security server host, right-click My Computer and select
Properties.
a On the Advanced tab, click Environment Variables.
b In the System variables group, select Path and click Edit.
c Type the path to the JRE directory in the Variable Value text box. Use a semicolon (;) to separate each
entry from other entries in the text box.
For example:
install_directory \VMware\VMware View\Server\jre\bin
2 On your View Transfer Server host, right-click My Computer and select Properties.
a On the Advanced tab, click Environment Variables.
b In the System variables group, select Path and click Edit.
c Type the paths to the JRE and Apache directories in the Variable Value text box. Use a semicolon (;)
to separate each entry from other entries in the text box.
For example: install_directory \VMware\VMware
View\Server\httpd\bin; install_directory \VMware\VMware View\Server\jre\bin
3 Click OK until the Windows System Properties dialog box closes.
Use an Existing PKCS#12 Certificate and Private Key
If your organization already has a valid server SSL certificate, you can use that certificate to replace the default
server SSL certificate provided with View Connection Server.
To use an existing certificate, you also need the accompanying private key. The PKCS#12 file format includes
both the server certificate and the private key.
If a PKCS#12 file contains a server certificate that is signed by an intermediate CA rather than by a root CA,
you must convert the PKCS#12 keystore to JKS format. See “Convert a PKCS#12 Keystore to JKS Format,” on
page 82.
You can use several different tools to generate PKCS#12 files. This procedure explains how to use the Internet
Information Services (IIS) Manager to generate a PKCS#12 file from an IIS certificate store, and how to use
openssl to extract a PEM format certificate and private key.
Prerequisites
If you want to create a certificate that you can use with a View Transfer Server instance, add openssl to the
system Path variable on your host. See “Add keytool and openssl to the System Path,” on page 80
VMware View Installation
80 VMware, Inc.