A Technology Journey
I am using VMware vSphere 7.0.3 for this lab. Before starting the deployment, ensure there are forward and reverse DNS records created for the ESXi host that vCenter will be installed on, the vCenter Server appliance itself, and optionally any NTP servers. Ideally, there should be localized NTP.
Continue reading “MyLab: VMware vSphere”Copy the file(s) to a system that has OpenSSL. If you are on a Windows machine, the easiest way to do this is to use Git for Windows (https://git-scm.com/download/win). Once installed, you can run Git Bash and will have access to OpenSSL. Linux and macOS will likely already have OpenSSL support in Terminal. If you are in a VMware environment, the ESXi hosts also have OpenSSL support.
It is highly likely the .pfx file will contain a password to protect the file. This password is required for the conversion process.
PEM files may have either a cer, crt, or pem file extension. These should be interchangeable, but some vendors are very particular about the file extension. Like anything, check the applicable documentation for recommendations.
Most vendors will require three files. Commonly I see the folllowing:
To get the machine certificate and signing certificates, run the following command:
openssl pkcs12 -in certificate-name.pfx -out machine.pem -nodes -nokeys
To get the encrypted private key, run the following command:
openssl pkcs12 -in certificate-name.pfx -out machine.key -nocerts
If you view the file, you will see that it is encrypted. Most systems will not take an encrypted key and will require an RSA Private Key.
openssl rsa -in machine.key -out machine-rsa.key
Now if you view the new file, you will see it is an RSA Private Key.
This is a prerequisite phase before configuring App Volumes Manager in the browser. A lot of this should already be accomplished in a production environment except the newly installed App Volumes Manager specific settings. This page can serve more than just for configuring security for App Volumes Manager.
At this point, the App Volumes Manager software should be installed. Reference the following article to install the App Volumes Manager: Installing VMware App Volumes 4 Manager – Part 1.
Rather than reiterate what’s already been written elsewhere that makes sense, I am just going to drop the appropriate links below and make notes where appropriate for reference.
I added the certificate in the following order: Root+Intermediate+Machine and named it adCA.pem. This file gets added to the C:\Program Files (x86)\CloudVolumes\Manager\config directory and then the App Volumes Manager service gets restarted.
Add the CA signed certificate and key to the following directory: C:\Program Files (x86)\CloudVolumes\Manager\nginx\conf
Directory to nginx.conf configuration file: C:\Program Files (x86)\CloudVolumes\Manager\nginx\conf — Make a copy before editing!
Edit lines 57 and 58 to reflect the certificate and key added earlier.
Restart the App Volumes Manager service.
Use the following commands to convert .p12 or .pfx files to PEM.
openssl pkcs12 -in mycaservercert.pfx -nokeys -out mycaservercert.pem openssl pkcs12 -in mycaservercert.pfx -nodes -nocerts -out mycaservercertkey.pem openssl rsa -in mycaservercertkey.pem -check -out mycaservercertkeyrsa.pem
ref: https://kb.vmware.com/s/article/2150281
Use this article to have App Volumes Manager trust the vCenter Server certificate. I could not find this information anywhere else besides this kb.
To resolve the issue, add the vCenter CA certificate to the cacert.pem
Make sure that the cacert.pem file has the complete chain including the vCenter server certificate.
Update: I added the certificates in the following order: Root+Intermediate+Machine to cacert.pem and copied the file into the C:/Program Files (x86)/CloudVolumes/Manager/config/ directory. I then restarted the App Volumes Manager service. When configuring the Machine Managers, the certificate error is not present.