Wall's View

Recently I had the pleasure of setting up GoDaddy certificates on a View Security Server.  In View 5.1 the process has changed somewhat and it reality it has gotten easier!  There are several good blogs as well as KB articles, listed at the end of this entry.  The one that actually outlines it is http://kb.vmware.com/kb/2032400.  

Using the Microsoft Certreq tool on a Windows 2008 R2 server that is the Security Server, here is an outline of the steps:

1.  Create the configuration file in the request.inf format.

;—————– request.inf —————–
[Version]

Signature=”$Windows NT$”

[NewRequest]

Subject = “CN=View_Server_FQDN, OU=Organizational_Unit_Name, O=Organization_Name, L=City_Name, S=State_Name, C=Country_Name” ; replace attributes in this line using example below
KeySpec = 1
KeyLength = 2048
; Can be 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
FriendlyName = “vdm”
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = “Microsoft RSA SChannel Cryptographic Provider”
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication

[RequestAttributes]

; SAN=”dns=FQDN_you_require&dns=other_FQDN_you_require”
;———————————————–

2.  Open the file in an editor and update the Subject field.

Subject = “CN=view.company.com, OU=Helpdesk, O=IT, L=Palo Alto, S=California, C=US”

3.  Save it to a folder such as C:\Certs.

Generate a CSR using the configuration file:

1.  Open a CMD prompt with “Run as Administrator”.  Change to the directory that the file was saved off to.

cd C:\certs

2.  Generate the CSR file.

certreq -new request.inf certreq.txt

3.  Open the “certreq.txt” file in an editor and paste that into the CA request to obtain a signed certificate.

4.  Save off the resulting certificate files from the CA and copy them into a cert.cer file (as well as the root and intermediate files, root.cer & intermediate.cer).

Import the signed certificate:

1.  Open a CMD prompt with “Run as Administrator”.  Change to the directory that the file was saved off to.

2.  In the directory with the *.cer files run the certreq tool again.

certreq – accept cert.cer

3.  If you originally had a self signed certificate, make sure to remove the friendly name of “vdm” from it.

4.  restart the View services or reboot.

Verify in the MMC snap in for Certificates:

http://pubs.vmware.com/view-51/index.jsp?topic=%2Fcom.vmware.view.installation.doc%2FGUID-FA1BE2EC-D8B9-472E-A4F9-09C79DFC94D5.html

http://pubs.vmware.com/view-51/index.jsp?topic=%2Fcom.vmware.view.installation.doc%2FGUID-E5EA22DE-E8CD-4E8D-8F76-C5105307D09F.html

http://pubs.vmware.com/view-51/index.jsp?topic=%2Fcom.vmware.view.installation.doc%2FGUID-42B85B91-DCFD-4C1D-8E7C-1AA0C81C0BFB.html

KB Articles:

http://kb.vmware.com/kb/2032400

http://kb.vmware.com/kb/2021537

http://kb.vmware.com/kb/2020913

Blogs: 

http://fojta.wordpress.com/2012/05/27/vmware-view-5-1-and-ssl-certificate-replacement/

http://my-virt.alfadir.net/2012/05/generate-view-5-1-certificat/