TLS Implementation for VCM
TECHNICAL WHITE PAPER / 23
Import the Certificates on the Collector Machines
Perform the following procedure on the new Collector machine, prior to running VCM Installation Manager.
Important: If you are performing this procedure as part of a certificate replacement process, you must manually install
the Enterprise and Collector Certificates in the Collectors’ certificate stores, and the Enterprise Certificate in the
Agents' certificate stores. See
Creating and Installing Certificates for Collectors on page 12
and
Delivering Initial
Certificates to Agents on page 15
.
1. Import the Enterprise Certificate into the local machine trusted root store.
2. Import the Collector Certificate into the local machine personal store.
3. The Enterprise and Collector Certificates are now available for use in the VCM installation.
MakeCert Options
Refer to the following table for a list of the options used in the previously described MakeCert commands, and their
definitions.
Note
The strings: AAAAAA-AAAAAA... and BBBBBBBB-BBBBB... represent GUIDS. VMware uses GUIDS to
help create unique names. GUIDS are a useful convention for programmatically creating uniqueness and are generally
not necessary in a manual process.
Field
Definition
-b, -e
Specify begin and end dates. Choose appropriate dates, or omit
them.
Note
You cannot enter a time with the date. The time will be
12:00AM GMT. If you chose today's date, it will probably refer to
early this morning.
-cy authority
Certificates are either "authority" or "end". End certificates are not
allowed to sign other certificates.
-eku 1.3.6.1.5.5.7.3.1
The Server Authentication OID, required only for the Collector
Certificate.
<filename>
Optional export file name. This file will not contain the private key.
The file should have a .cer or .pem extension.
