6.4

Replace the Default Certificate for the Broker Agent
A self-signed certicate is generated when you rst install the broker agent. The broker agent uses this
certicate by default to authenticate to the vRealize Operations for Published Applications adapter. You can
replace the self-signed certicate with a certicate that is signed by a valid certicate authority.
Prerequisites
n
Verify that you can connect to the XD-XA Session host where the broker agent is installed.
n
Verify that the keytool utility is added to the system path on the data collector host where the broker
agent is installed.
n
Verify that you have the password for the certicate store. You can obtain this password from the
msgserver.properties le. See “Broker Agent Certicate and Trust Store Files,” on page 58.
n
Become familiar with the Java keytool utility. Documentation is available at hp://docs.oracle.com
Procedure
1 Log in to the vRealize Operations for Published Applications Server host where the broker agent is
installed.
2
Use the keytool utility with the -selfcert to generate a new self-signed certicate.
Because the default self-signed certicate is issued to VMware, you must generate a new self-signed
certicate before you request a signed certicate. The signed certicate must be issued to your
organization.
For example:
keytool –selfcert –alias v4pa-brokeragent –dname dn-of-org –keystore v4pa-brokeragent.jks
dn-of-org is the distinguished name of the organization to which the certicate is issued, for example,
"OU=Management Platform, O=VMware, Inc. , C=US".
By default, the certicate signature uses the SHA1withRSA algorithm. You can override this default by
specifying the name of the algorithm in the keytool utility.
3
Use the keytool utility with the -certreq option to generate the certicate signing request.
A certicate signing request is required to request a certicate from a certicate signing authority.
For example:
keytool –certreq –alias v4pa-brokeragent –file certificate-request-file -keystore v4pa-
brokeragent.jks
certicate-request-le is the name of the le that will contain the certicate signing request.
4 Upload the certicate signing request to a certicate authority and request a signed certicate.
If the certicate authority requests a password for the certicate private key, use the password
congured for the certicate store.
The certicate authority returns a signed certicate.
Chapter 12 Replacing the Default Certificates
VMware, Inc. 61