6.5

Replacing the Default Certificates
By default, the View adapter and the broker agent use self-signed certicates for authentication and data
encryption. For increased security, you can replace the default self-signed certicates with certicates that
are signed by a certicate authority.
Replace the Default Certificate for the View Adapter
A self-signed certicate is generated when you rst install the View adapter. The desktop message server
and the broker message server use this certicate by default to authenticate to the agents. You can replace
the self-signed certicate with a certicate that is signed by a valid certicate authority.
Prerequisites
n
Verify that you can connect to the node where the View adapter is running.
n
Verify that you have the password for certicate store. You can obtain the password from the
msgserver.properties le. See “View Adapter Certicate and Trust Store Files,” on page 16.
n
Become familiar with the Java keytool utility. Documentation is available at hp://docs.oracle.com.
Procedure
1 Log in to the node where the View adapter is running.
2 Navigate to the View adapter's work directory.
Platform Directory Location
Linux
/usr/lib/vmware-
vcops/user/plugins/inbound/V4V_adapter3/work
Windows
C:\vmware\vcenteroperations\user\plugins\inbound\V4V_adapte
r3\work
3
Use the keytool utility with the -selfcert option to generate a new self-signed certicate for the View
adapter.
Because the default self-signed certicate is issued to VMware, you must generate a new self-signed
certicate before you can request a signed certicate. The signed certicate must be issued to your
organization.
For example:
keytool –selfcert –alias v4v-adapter –dname dn-of-org –keystore v4v-adapter.jks
dn-of-org is the distinguished name of the organization to which the certicate is issued, for example,
"OU=Management Platform, O=VMware, Inc., C=US".
By default, the certicate signature uses the SHA1withRSA algorithm. You can override this default by
specifying the name of the algorithm with the -sigalg option.
4
Use the keytool utility with the -certreq option from the adapter work directory to generate a
certicate signing request.
A certicate signing request is required to request a certicate from a certicate signing authority.
For example:
keytool –certreq –alias v4v-adapter –file certificate-request-file -keystore v4v-adapter.jks
certicate-request-le is the name of the le that will contain the certicate signing request.
VMware vRealize Operations for Horizon Security
18 VMware, Inc.