6.4

2
Use the keytool utility with the -selfcert to generate a new self-signed certicate.
Because the default self-signed certicate is issued to VMware, you must generate a new self-signed
certicate before you request a signed certicate. The signed certicate must be issued to your
organization.
For example:
keytool –selfcert –alias v4v-brokeragent –dname dn-of-org –keystore v4v-brokeragent.jks
dn-of-org is the distinguished name of the organization to which the certicate is issued, for example,
"OU=Management Platform, O=VMware, Inc. , C=US".
By default, the certicate signature uses the SHA1withRSA algorithm. You can override this default by
specifying the name of the algorithm in the keytool utility.
3
Use the keytool utility with the -certreq option to generate the certicate signing request.
A certicate signing request is required to request a certicate from a certicate signing authority.
For example:
keytool –certreq –alias v4v-brokeragent –file certificate-request-file -keystore v4v-
brokeragent.jks
certicate-request-le is the name of the le that will contain the certicate signing request.
4 Upload the certicate signing request to a certicate authority and request a signed certicate.
If the certicate authority requests a password for the certicate private key, use the password
congured for the certicate store.
The certicate authority returns a signed certicate.
5
Copy the certicate le to the conf directory and run the keytool utility with the -import option to
import the signed certicate into the certicate store for the broker agent.
You must import the certicate le to the certicate store for the broker agent so that the broker agent
can start using the signed certicate.
For example:
keytool –import –alias v4v-brokeragent –file certificate-filename -keystore v4v-
brokeragent.jks
certicate-lename is the name of the certicate le from the certicate authority.
6
Run the keytool utility with the -import option to import the certicate authority root certicate into
the trust store le for the broker agent.
For example:
keytool -import -alias aliasname -file root_certificate -keystore v4v-truststore.jks -
trustcacerts
root_certicate is the name of the certicate authority root certicate.
7 Restart the broker agent to start using the new certicate.
You can restart the broker agent by using the vRealize Operations Horizon Broker Agent Seings
wizard, or by restarting the vRealize Operations Horizon Broker Agent Service.
What to do next
After you restart the broker agent, you must pair it with the View adapter. See “Certicate Pairing,” on
page 21.
VMware vRealize Operations for Horizon Security
20 VMware, Inc.