SSL : Part 2 : Signing a CSR with your Microsoft Certificate Authority

In Part 1 of this series, we looked at setting up a Certificate Authority. You will need a CA in order to complete Part 2 and the subsequent parts in this series.

In order to trust certificates, a CSR needs to be signed by a CA that is trusted on the devices you will connect from. In Part 3 we will look at creating a CSR for vRLI but this walk through will be relevant for all the future parts in this series that require a CSR to be signed.

Step 1. Copy the CSR file you have to the server running the CA and then open the Certification Authority configuration app. Right click the CA, click All Tasks and then click Submit new request…

Screenshot.jpg

Step 2. A file selector will pop up and ask you for the .CSR file. Select it and click Open.

Screenshot_001.jpg

The CSR is loaded into the CA and if everything is good, it will put the request into the Pending Requests folder.

Screenshot_002.jpg

Step 3. Right click the request and select All Tasks and then Issue.

Screenshot_003.jpg

The certificate is now placed in the Issued Certificates folder.

Screenshot_004.jpg

Step 4. Double click the issued certificate and a viewer window opens. Here you can see that the certificate is used to ensure the identity of a and proving the identity of a remote computer.

Screenshot_005.jpg

Step 5. Click the Details tab. Here you can see all the specifics of the certificate. Click the Copy to File button. This is going to allow us to save the certificate file for installation on the server.

Screenshot_006.jpg

Step 6. Click Next

Screenshot_007.jpg

Step 7. Ensure that you select Base-64 encoded for the output format and click Next.

Screenshot_008.jpg

Step 8. Enter a file name for the file and click Next.

 Screenshot_010.jpg
Step 9. Finally click Finish.
Screenshot_011.jpg
You now have the certificate in a .cer Base-64 encoded file ready for upload to the server.
In Part 3 of this series we will look at creating a CSR for vRealize Log Insight, get it signed by our CA and deploying the signed certificate to the server.

 

SSL : Part 1 : Building a Microsoft Certificate Authority for your lab

In the first part in this series, I am going to walk you through setting up a simple Certificate Authority on Windows 2016 Server for a lab environment. If you want to get rid of those annoying warnings every time you open a web session for vCenter, or ESXi or pretty much any VMware product, you have to have a signed and trusted certificate on the web server. Without it, you are required to acknowledge the risk of connecting to the site and then clicking to continuing on to that site. This is particularly painful when you are trying to demo a product like the vROps Tenant App for vCD that has a iFrame that connects to the App. Unless you go and do the acceptances before you start the demo, you are stuck getting rid of these warnings which interrupt proceedings. In my lab environment, I setup a Microsoft Certificate Authority to sign certificates for the various tools I am running allowing me to get rid of that warning and have all green URLs in my browser.

First things first, you need to have a VM running Windows Server 2016. I will not go into the details of setting up a Windows Server here.

Step 1. We need to add the Certificate Authority Role to the server. Open the Server Manager and then select Add Roles and Features.

I wonder.jpg

Step 2. Click Next on the information page.

I wonder_001.jpg

Step 3. Keep role-based or feature-based installation selected and click Next.

I wonder_002.jpg

Step 4. There should only be one destination server and it should be the one you are working on. Click Next.

I wonder_003.jpg

Step 5. Next in the Server Roles selection, tick the Active Directory Certificate Services and wait for the popup for the additional features that are required for ADCS.

I wonder_004.jpg

Once this pops up, click Add Features.

I wonder_005.jpg

Step 6. You should now have a tick against Active Directory Certificate Services. Click Next.

I wonder_006.jpg

Step 7. On the select features page, leave it as is and click Next.

I wonder_007.jpg

Step 8. Click Next on the ADCS information page.

I wonder_008.jpg

Step 9. Select Certification Services in the Role Services and click Next.

I wonder_009.jpg

Step 10. Select Restart the desination server automatically if required and click Yes in the popup. Finally click Install.

I wonder_010.jpg

Step 11. The installation of the ADCS will start.

I wonder_011.jpg

Step 12. If all goes well, the installation should complete and you can click close. (On a fresh 2016 install a restart is not usually required.)

I wonder_012.jpg

Step 13. Go back to your Server Manager Dashboard and you should see a yellow exclamation. This indicates you need to complete the ADCS configuration.

I wonder_013.jpg

Step 14. Click the flag and then click Configure Active Directory Certificate Services on th…. in the Post-deployment Configuration item.

I wonder_014.jpg

Step 15. Keep the default credentials and click Next.

I wonder_020.jpg

Step 16. Tick Certification Authority and click Next.

I wonder_016.jpg

Step 17. Keep Standalone CA selected and click Next. For an Enterprise CA you need to be connected to a domain and that is not needed for our purposes.

I wonder_017.jpg

Step 18. You want to deploy a Root CA unless you have a Root CA that this CA can be a subordinate of. Click Next.

I wonder_018.jpg

Step 19. Leave create new private key selected and click next.

I wonder_019.jpg

Step 20. The default Key Length and algorithm should be sufficient for lab needs. Click Next

I wonder_020.jpg

Step 21. Give the CA a name and click Next.

I wonder_023.jpg

Step 22. The default validity is 5 years. I normally make it 10. Once you have set it, click Next.

I wonder_024.jpg

Step 23. Leave the default database locations unless you specifically want to change them and click Next.

I wonder_025.jpg

Step 24. Click Configure on the summary page.

I wonder_026.jpg

Step 25. And you should now have a configured Certificate Authority.

I wonder_027.jpg

Step 26. On the Server Manager Dashboard, click the Tools Menu and then Certification Authority.

I wonder_028.jpg

Step 27. And here you should see your newly minted CA.

I wonder_029.jpg

Step 28. Right click lab-ca and click Properties. You will see Certificate #0 in the list which is the public certificate for the CA itself. Click View Certificate.

I wonder_030.jpg

Step 29. You will see the summary page for the certificate that indicate the Validity period. (10 years in this case)

I wonder_031.jpg

Step 30. In order for devices you use to trust certificates signed by this Certificate Authority, you will need to install the public certificate of the CA into the Trusted CAs list on each device.
Click the Details tab.

I wonder_032.jpg

Step 31. Now click Copy to File and click Next.I wonder_033.jpg

Step 32. You need to export the certificate in Base-64 Encoded format as you will use the contents for various VMware solutions. Select Base-64 and click Next.

I wonder_034.jpg

Step 33. Select a location and name for the file and click Next.

I wonder_035.jpg

Step 34. Click Finished on the summary page.

I wonder_036.jpg

Step 35. If you now open the file you just saved with Notepad, it will look something similar to this.

I wonder_037.jpg

And that’s it. You are now ready to mint certificates for your lab servers. Don’t forget to save the public certificate into the Trusted Root Certificates of your devices that you use to manage the lab environment.

In part 2 we will look at signing a CSR (Certificate Signing Request) with our new CA.

 

What is the vROps Tenant App for vCD …… and how to get it up and running.

This is my first VMware blog and is going to be all about the recently released vRealize Operations Manager Tenant App for vCloud Director. This is a great way to expose vROps performance metrics to tenants in a vCD environment and allow them to only see metrics relevant to their organization. vCD 9.x has been a revolution in the way vCD is evolving and before you say vCD is dead, go to this great blog by Daniel Paluszek and read all about how it is not! This is an awesome way for providers to give their tenants more visibility into the performance of their environments and will help the tenants to do more of the first line maintenance themselves. They will also feel comfortable being able to see first hand what is and isn’t performing in their cloud.

So onto the setup of the Tenant App. There are three main parts to getting this done, installing an AMQP broker, installing the App and configuring vCD and vROps.

Before we get into the nitty gritty, we need to download the Management Pack and the Appliance. You can find both of them here. You get the management pack by clicking the green ‘Try’ button to the right of the screen, and the appliance .ova by clicking ‘Appliance: vRealize Operations Tenant App for vCloud Director’ in the list of resources.

 

Installing an AMQP Broker

For this part I wanted to use something simple and pretty much out the box and bitnami have a great pre-built VM in .ova format that is just that. It is an install of the tried and trusted RabbitMQ and you can go here to get it. Deploy the .ova and start it up. Once it is done with it’s setup during boot, you will get a screen something like this in the console:

pics_006.png

Log into the console using ‘bitnami’ and ‘bitnami’. You will be required to set a new password during the login process.

We are going to configure the firewall first to allow access to the Management Portal and the application itself. Execute the following at the prompt
sudo ufw allow 15672/tcp
sudo ufw allow 5672
15672 is the port for the RabbitMQ Management Panel and 5672 is the default RabbitMQ Application port.

Print out the fire wall rules and they should look something like this:
pics_002.png

Next we need to allow connections to RabbitMQ. By default, RabbitMQ only accepts connections from the local host.
Stop the RabbitMQ service
sudo /opt/bitnami/ctlscript.sh stop
and edit the configuration file
sudo vi /opt/bitnami/rabbitmq/etc/rabbitmq/rabbitmq.config
You need to change the tcp listener to accept connections from all or certain IPs depending on your environment. I setup my instance to accept connections from any IP. Change 127.0.0.1 to 0.0.0.0 to allow any IP to connect. Below are the before and after edits.
pics.png

pics_001.png

Finally, restart the RabbitMQ service
sudo /opt/bitnami/ctlscript.sh start

Next we need to configure the RabbitMQ server. We are going to do this from the Management Panel. Connect to http://<YourServerIP&gt;:15672 and use the username and password from the console splash screen.
pics_014.png
In my case it is ‘user’ and ‘jpoDZzvsrOQ2’

Once into the Management Panel, click the ‘Admin’ Tab and then click ‘Add a user’. I created a user called ‘vcd’ and entered a password and clicked ‘Add user’.
pics_007.png
The ‘vcd’ user is now in the list. Click it to configure the permissions. I used the defaults and just clicked ‘Set permission’ and ‘Set topic permission’ to allow the user to access the Virtual Host and AMQP default exchange.
pics_008.png

With that, you are all set with the RabbitMQ configuration.

Let’s get vCD connected up. Connect to the flex client (you cannot do this in the HTML5 client just yet) and go to Administration -> Extensibility and configure the AMQP Broker Settings. Below is what I configured in mine : (Remember to click the Test AMQP to ensure all is good)
pics_009.png

And now vCD is wired up to the AMQP Broker.

 

Installing the vROps Management Pack

Log into vROps as the admin and go to the Administration -> Solutions page. Click the green plus to add a solution and select the .pak file you downloaded earlier. Once the install is completed, click the Configure gears icon and enter your vCD instance details. Mine looks something like this:
pics_011.png
Make sure to test the connection to confirm all is working.

And that is it for the installation of the Management Pack.

 

Deploy the Appliance

The final step is to deploy the appliance and register the plugin with vCD. Deploy the Appliance .ova file you downloaded earlier and be sure to configure all the settings correctly during the deployment process. These settings are difficult to change after deployment and if you need to change anything, you are pretty much better off just redeploying. (As of writing this blog, deploying the appliance from the vCenter HTML5 client does not work so you need to use the flex client.)
pics_010.png

Once the deployment is done and you start the VM, you should see the URL to connect to in the console.

The final piece of the puzzle is to register the plugin with vCD. You do this from the console of the Tenant App you just installed. Connect as root and run

cd /opt/vmware/plugin

python publish.py -H vcd-dc1-001.local -u administrator@system -p <YourAdminPassword>

Note that you must use administrator@system as the username and not administrator@vsphere.local.

And that’s it! You should now be able to log into the HTML 5 vCD portal and open the Operations Manager screen. Mine looks like this:
pics_012.png