A few days ago I decided to redeploy the vCloud Connector Server and Node to my lab. After performing the initial installation I set about replacing the default untrusted SSL certificates with genuine ones, only to receive an error.

Regardless of what I tried, when came to enable SSL I got the following message:

It would appear the GUI was having none of it. It was time to override it by dropping into the shell.

First I downloaded my Root and Issuing CA certificates from certificate authority, and then using SFTP I copied them to the vCloud Connector Server. These have to be in base64 format.

I then SSH’d to the vCC Server and logged in as admin. The default password is “vmware” (minus quotes), but I had obviously changed mine by this point. I then SU’d to root.

First I removed the existing certificate using:

/usr/java/latest/bin/keytool -delete -alias hcserver -keystore /usr/local/tcserver/vfabric-tc-server-standard/server/conf/tcserver.jks -storepass changeme

Next I added my Root CA certificate to the keystore using (substitute text in bold accordingly):

/usr/java/default/bin/keytool -import -trustcacerts -alias RootCA -file RootCA.crt -keystore cacerts -storepass changeit

In the above example, the password changeit is hardcoded. I then did the same again with my Issuing CA certificate:

/usr/java/default/bin/keytool -import -trustcacerts -alias IssuingCA -file IssuingCA.crt -keystore cacerts -storepass changeit

Before installing a new certificate I first had to generate a new key using:

/usr/java/latest/bin/keytool -genkey -validity 3650 -keyalg RSA -keysize 2048 -alias hcserver -keystore /usr/local/tcserver/vfabric-tc-server-standard/server/conf/tcserver.jks -storepass changeme

In the questions that followed, I set the first and last name to the FQDN of the vCloud Connector Server.

I then generated the certificate signing request (substitute text in bold accordingly):

/usr/java/latest/bin/keytool -certreq -alias hcserver -file /home/admin/hcserver.csr -keystore /usr/local/tcserver/vfabric-tc-server-standard/server/conf/tcserver.jks -storepass changeme

Using SFTP I retrieved the CSR and submitted it to my certificate authority using:

certreq -submit -config "issuingca.mdb-lab.com\mdb-lab.com Issuing CA" -attrib "CertificateTemplate:VMwareSSL" hcserver.csr vCloudConnectorServer.crt

I then copied the issued certificate back to the vCloud Connector Server and imported it using (substitute text in bold accordingly):

/usr/java/latest/bin/keytool -import -alias hcserver -file /home/adminvCloudConnectorServer.crt -trustcacerts -keystore /usr/local/tcserver/vfabric-tc-server-standard/server/conf/tcserver.jks -storepass changeme

If the certificate installed correctly you will receive:

Certificate reply was installed in keystore

I verified this using:

/usr/java/latest/bin/keytool -list -keystore /usr/local/tcserver/vfabric-tc-server-standard/server/conf/tcserver.jks -storepass changeme

This gave me:

I then restarted the service:

/etc/rc.d/hcserver-tomcat restart

The last remaining step was to enable SSL on the admin page at:

https://<vCloud Connector Server FQDN:5480

And that’s all there is to it!