6.2

You can update or replace certificates after deployment. For example, you may choose to use self-signed
certificates during deployment, but then obtain certificates from a trusted authority before going live with
your vRealize Automation implementation or a certificate may expire.
Table 2‑11. Certificate Implementations
Component
Minimal Deployment (non
production) Distributed Deployment (production ready)
Virtual Appliances Generate a self-signed certificate
during appliance configuration.
For each appliance cluster, obtain a multi-use certificate, such as a
Subject Alternative Name (SAN) certificate, from an internal or
external certificate authority. Wildcard certificates are also
supported.
IaaS Components During installation, accept the
generated self-signed certificates or
select certificate suppression.
Obtain a multi-use certificate, such as a Subject Alternative Name
(SAN) certificate, from an internal or external certificate authority
that your Web client trusts. Install the same multi-use certificate on
each IaaS installation machine.
Note If you do not have sufficient permissions to install IIS domain certificates, your Web browser
prompts you with security exceptions when you open vRealize Automation. Follow the instructions for
your browser to permanently trust each self-signed certificate.
Certificate Chains
If you use certificate chains, specify the certificates in the following order:
n
Client/server certificate signed by the intermediate CA certificate
n
One or more intermediate certificates
n
A root CA certificate
Include the BEGIN CERTIFICATE header and END CERTIFICATE footer for each certificate when you
import certificates.
Security Passphrase
vRealize Automation uses security passphrases for database security. A passphrase is a series of words
used to create a phrase that generates the encryption key that protects data while at rest in the database.
Use the same passphrase for all components in a distributed environment.
Follow these guidelines when creating a security passphrase for the first time.
n
Use the same passphrase across the entire installation to ensure that each component has the same
encryption key.
n
Use a phrase that is greater than eight characters long.
n
Include uppercase, lowercase and numeric characters, and symbols.
n
Memorize the passphrase or keep it in a safe place. The passphrase is required to restore database
information in the event of a system failure. Without the passphrase, you cannot restore successfully.
Installation and Configuration
VMware, Inc. 32