6.3

Table Of Contents

3 Generate a self-signed certificate with a new private key.

openssl req -x509 -nodes -days 9999 -newkey rsa:2048 -keyout HOSTNAME.key -out HOSTNAME.cer -

subj "/CN=HOSTNAME"

4 Convert the certificate and the private key to a .pfx file.

openssl pkcs12 -export -out HOSTNAME.pfx -inkey HOSTNAME.key -in HOSTNAME.cer -name

"HOSTNAME" -passout pass:

5 Deploy the generated SSL certificate (HOSTNAME.PFX file in the bin folder) to the remote server and

import it there .

Import SSL Certificate on Remote Machine

Upload the certificate PFX file to the remote server. You can do so by attaching your local disk drive to the

Remote Desktop session and copying the file in Explorer.

Procedure

Import the certificate into the Local Machine certificate store by pasting the following script in the

PowerShell console:

Replace path-to-pfx-file with the path to the PFX file. For example, C:\OpenSSL-Win64\bin\.

function Install-Certificate ($certPath, [string]$storeLocation = "LocalMachine", [string]

$storeName = "My")

{

$cert = New-Object

System.Security.Cryptography.X509Certificates.X509Certificate2($certPath,"",

"MachineKeySet,PersistKeySet")

$store = New-Object

System.Security.Cryptography.X509Certificates.X509Store($storeName, $storeLocation)

$store.Open("ReadWrite")

$store.Add($cert)

$store.Close()

"Thumbprint: $($cert.Thumbprint)"

}

Install-Certificate path-to-pfx-file\xenapp-dc.vcops.local.pfx

The output of this script is a certificate thumbprint, which is required when setting up HTTPS listener

for the WinRM service. If you generated SSL certificate in the IIS Manager, you can get its thumbprint

using the following PowerShell command:

Get-ChildItem cert:\LocalMachine\My | Where-Object { $_.Subject -eq "CN=HOSTNAME" }

Configure Configure WinRM HTTPS Listener

All the queries go through WinRM. Therefore, configure the WinRM HTTPS listener on the machine where

the broker agent is installed.

Procedure

To configure WinRM HTTPS listener on the remote server, run the following command on the

PowerShell prompt:

winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="xenapp-

dc.vcops.local";CertificateThumbprint= " 4D9157F66867A73A55A0B9F6DAC045EB52D4BF9A"}

Chapter 7 Enable HTTPS Protocol for PowerShell Remoting

VMware, Inc. 35