Katalykt: octobre 2014

While replacing the default SSL Certificates in the vSphere suite could seems challenging, the process in the View suite is much easier.

This article will cover the replacement of the default SSL certificates for both VMware View Connection Server and VMware View Composer.

OpenSSL and a Windows 2008 R2 CA are used to generate our CA Signed SSL certificates.

As a reminder, View Composer can be installed on the vCenter server or on another server (in case of heavy load).

My domain katalykt.lan is designed as follow:

- dc0001.katalykt.lan: This is the domain controller and our Certification Authority.

- vc0001.katalykt.lan: This is the vCenter and our View Composer server.

- cs0001.katalykt.lan: This is our View Connection Server.

Let's start by creating our working directory, under

C:\OpenSSL-Win32\Certificates

Let's create the following folders:

Composer
ConnectionServer

Creating the OpenSSL Template files

In this part, we'll create a configuration file for those folders in their respective folder:

Composer.cfg

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:vc0001, DNS:vc0001.katalykt.lan
 
[ req_distinguished_name ]
countryName = FR
stateOrProvinceName = Normandie
localityName = Caen
0.organizationName = Katalykt
organizationalUnitName = ViewComposer
commonName = vc0001.katalykt.lan

ConnectionServer.cfg

[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:cs0001, DNS:cs0001.katalykt.lan
 
[ req_distinguished_name ]
countryName = FR
stateOrProvinceName = Normandie
localityName = Caen
0.organizationName = Katalykt
organizationalUnitName = ConnectionServer
commonName = cs0001.katalykt.lan

Creating the SSL Certificates CA Template

A specific CA SSL Certificate Template is required for VMware View. See my article about Preparing a Microsoft CA SSL Certificate Template for VMware View 5.2 here to create one.

I've granted my service account srv-vcenter the right to Enroll my VMwareViewSSL Template here (this is done by modifying the template)

Generating the SSL Certificates

So now that we've got everything that we need we can just go ahead and create a script which will do the manual labor for us!

This script will do as follow for each component:

Create a private key rui.key in RSA 2048
Create a Certificate Signing Request from the current OpenSSL Template
Submit the previous request to the CA and (hopefully) generate the Certificate rui.crt
Create the Personal Information Exchange file which will bundle our Certificate along with its private key

Create_View_SSL.bat

REM Change this according to your needs
Set OPENSSL=c:\OpenSSL-Win32\bin\openssl.exe
Set SSLPATH=c:\OpenSSL-Win32\Certificates
Set MSCA=DC0001\katalykt-DC0001-CA
Set MSCATEMPLATE=VMwareViewSSL
  
REM Core processing
echo PROCESSING: View Composer SSL Certificate
cd /d %SSLPATH%\Composer
%OPENSSL% genrsa 2048 > rui.key
%OPENSSL% req -out rui.csr -key rui.key -new -config Composer.cfg
certreq -submit -config %MSCA% -attrib "CertificateTemplate:%MSCATEMPLATE%" rui.csr rui.crt
%OPENSSL% pkcs12 -export -in rui.crt -inkey rui.key -name vdm -passout pass:testpassword -out rui.pfx
  
echo PROCESSING: View Connection Server SSL Certificate
cd /d %SSLPATH%\ConnectionServer
%OPENSSL% genrsa 2048 > rui.key
%OPENSSL% req -out rui.csr -key rui.key -new -config ConnectionServer.cfg
certreq -submit -config %MSCA% -attrib "CertificateTemplate:%MSCATEMPLATE%" rui.csr rui.crt
%OPENSSL% pkcs12 -export -in rui.crt -inkey rui.key -name vdm -passout pass:testpassword -out rui.pfx

Replacing the View Composer Certificate

If you already have a View Connection Server up and linked to an existing View Composer then make sure to stop it's services before replacing View Composer SSL certificate.

As you may already know, View Composer is installed either on the vCenter or on a side server. In this case it's hosted on my vCenter.

The first step is to stop the VMware View Composer service before proceeding any further.

The goal of this operation is to import our previously generated Personal Information Exchange rui.pfx into the View Composer server Personal store so that it may use both the SSL Certificate along with its private key.

So we hit the mmc.exe component where the View Composer is installed and load the Certificates Snap-in.

We pick the Computer account here.

I'm picking Local computer here since the mmc snap-in is running on the View Composer server.

Once the operation done, we browse to Personal >> Certificates. If you already have View Composer installed then you should be able to see the default Self Signed SSL Certificate in there.

The next step is to import our rui.pfx into the Certificates folder.

Using the contextual menu on the Certificates folder we do All Tasks > Import... to import it in there.

The first thing is to select the View Composer's rui.pfx file.

We use the password testpassword here (if you haven't changed it from the script that is) and we absolutely need to mark the key as exportable by ticking the option Mark this key as exportable...

Finally we place it in the Personal store.

Once done, we should be able to see our SSL certificate in the Personal store!

If you open up your SSL certificate you should see that a private key is associated with it thanks to the message "You have a private key that corresponds to this certificate".

If the SSL certificate doesn't have an associated private key then the replacement will not work (remember that the SSL Certificate template need to allow the private key export!)

Now that we got our SSL Certificate in our Personal store we can go ahead and replace the existing one.

This step is done by using the SviConfig.exe tool present on the View Composer server.

"c:\Program Files (x86)\VMware\VMware View Composer\SviConfig.exe" -operation=replacecertificate -delete=false

Note that we put the delete switch on false to keep the existing SSL Certificate in the store (we can always delete it later on)

Once the utility launch, simple select the new SSL certificate and everything else will be done automatically!

You may delete (or export as a backup) the old Certificate now.

And that's it! Our View Composer certificate has been changed! Make sure to restart the service!

Replacing the View Connection Server Certificate

View Connection Server SSL Certificate replacement is quite similar to the View Composer's one.

Our last rui.pfx has to be loaded onto the Connection Server personal certificate store. The only difference is that its "friendly name" need to be called vdm (It will only look for SSL Certificates with that friendly name)

Replacing the SSL Certificate of the View Connection Server is a good practice for many reasons. For instance your clients will view the Connection Server as a valid CA Signed entity when they connect through the View Horizon Client (No more red warning about Self Signed yay!)

Let's start our operation by stopping all View components services.

Via the mmc.exe component on the View Connection Server we add the Certificates Snap-in and load the Computer Account (This is the same process as the Composer's one above) on the Local computer.

Once more, we have the default SSL Certificate in there!

The next step is to import our rui.pfx into the Certificates folder.

Using the contextual menu on the Certificates folder we do All Tasks > Import... to import it in there.

The first thing is to select the View Connection Server rui.pfx file.

We use the password testpassword here (if you haven't changed it from the script that is) and we absolutely need to mark the key as exportable by ticking the option Mark this key as exportable...

Finally we place it in the Personal store.

Right now we have both the old and the new SSL Certificate. Make sure that the new SSL Certificate has the "vdm" Friendly Name set otherwise it will not be loaded.