SSL certificates

Replace the Cloud Management Platform (CMP) appliance’s self-signed certificate with one your clients trust, so browsers can verify the connection

  2 minute read  

To log in to the CMP appliance for the first time, you must accept the self-signed certificate. To let your browser verify the certificate afterward, configure CMP with a certificate trusted by your clients.

CMP requires a certificate issued by either a public or a private CA. Ensure all your client and user devices trust this CA.

Install a signed certificate

If you already have a signed certificate and key in PEM (Base64-encoded) format, update the certificate on the CMP appliance via SSH/SCP. Otherwise, first generate a CSR.

  1. Copy your PEM-formatted SSL cert to /etc/pki/tls/certs/localhost.crt.

  2. Copy your PEM-formatted SSL key to /etc/pki/tls/private/localhost.key.

  3. Set the file permissions:

    chmod 400 /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key

  4. Restart CMP: service httpd restart.

Generate a CSR

If you do not have a certificate, create a CSR to be signed by your certificate authority, using the following steps on the CMP appliance via SSH.

  1. Create an OpenSSL configuration file (for example, req.conf) and fill out the details for your CSR:

    [req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = VA
L = City
O = YourOrganization
OU = YourOrganizationUnit
CN = cloudbolt.example.com
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = cloudbolt.example.com

  2. Update the hostname for your CMP instance in both places (for maximum client compatibility): CN = and DNS.1 =.

  3. Add hostnames at the end of the file if you need additional branded portals:

    DNS.3 = portal2.example.net

  4. Run the following command to create the CSR and a new key from the configuration file:

    openssl req -new -out cloudbolt.csr -newkey rsa:2048 -nodes -sha256 -keyout new_localhost.key -config req.conf

  5. Submit cloudbolt.csr to your chosen certificate authority.

  6. This command also generates new_localhost.key, which does not need to be shared with the certificate authority. Use it when you receive the certificate file from your CA, then see Install a signed certificate for installation instructions.