Employ signed DoD certificates on VirtualCenter.
To create SSL/TLS certificates, the server administrator should use the site certificate ordering processes to obtain DoD PKI certficiates. Typically, the system administrator must use the Web Server or Web Server operating system tools as appropriate to generate the Public Key Cryptography Standard (PKCS) #10 certificate request. However, the following programs may be used to create and retrieve the signed certificate.
1. Serveral programs are needed to create the openssl certificates. These include Activestate Perl, openssl for Win32, and Visual C++ 2008 Redistribute. To get these programs go to the following websites and download them:
Note: These URL links may have changed since the release of the checklist.
a. Activestate Perl - Use http://www.activestate.com/activeperl/ and click on "ActivePerl Download Now".
b. Openssl for Win32 – Use http://www.slproweb.com/products.htm
c. Visual C++ 2008 Redistribute - Use http://www.microsoft.com/downloads/details.aspx?familyid=9B2DA534-3E03-4391-8A4D-074B9F2BC1BF&displaylang=en
2. Navigate to the OpenSSL directory (c:\openssl\bin\) on the VirtualCenter Server.
3. Generate the RSA key for the server and the certificate signing request (CSR):
openssl req -new -out filename.csr
When prompted enter the following: (Do not type the quotations)
For Country Name, type "US"
For State or Province Name, type "."
For Locality Name, type "."
For Organization Name, type "U.S. Government"
For Organizational Unit Name, type "OU=DISA, OU=PKI, OU=DoD"
For Common Name, type your Fully Qualified Domain Name of your server (i.e. server.disa.mil)
For Email Address, type your email address
4. The output from this command will yield two files: filename.csr and privkey.pem
5. Upload/Copy the filename.csr to the Regular SSL Server Enrollment Form for the DoD PKI site. You may use either of the two sites below.
Note: These Certificate Authorities may have been decommissioned since the release of the checklist. If so, please use the most current Certificate Authority for enrolling your certificate request.
CA-17 URL - https://ca-17.c3pki.chamb.disa.mil/ca
CA-18 URL - https://ca-18.c3pki.den.disa.mil/ca
6. You will be emailed that your certificate is ready and you will retrieve your signed certificate from the CA.
7. In addition, you must create a PFX-formatted certificate file specific for Windows. The filename.pfx file is a concatenation of the server’s certificate and private key, exported in the PFX format; this file is then copied to the sub-directory on the VirtualCenter Server.
Perform the following command: (filename is the name of your certificate file)
C:\openssl\bin\Openssl pkcs12 –export in filename.crt –inkey privkey.pem –name filename –passout pass:testpassword –out filename.pfx
8. Put the new signed certificate, private key, and filename.pfx in the C:\Documents and Settings\All Users\Application Data\VMware\VMware
VirtualCenter\SSL\ directory. Move the old certificates from the directory and put them somewhere safe for backup purposes.