Add AD certificate to Log Insight manually from command line
search cancel

Add AD certificate to Log Insight manually from command line

book

Article ID: 315958

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

This article will guide you to include the root CA from which the AD cert was issued into Log Insight. This will make it so that new certificates will be automatically accepted while accessing Log Insight using AD accounts.

 


Symptoms:
  • After AD certificate change, vRealize Log Insight loses the ability to login using AD accounts

 


Environment

VMware vRealize Log Insight 8.x

Cause

The new AD certificates are not available within the keystore file.

Resolution

To add your AD's certificate into vRealize Loginsight's keystore, please follow the below steps:
  

  1. Using a utility such as WinSCP or FileZilla, copy the root certificate used to sign your new AD cert to all nodes in your Log Insight cluster 
  2. SSH as root to vRealize Log Insight primary node.
  3. Take a backup of the keystore file
cp /usr/java/jre-vmware/lib/security/cacerts /usr/java/jre-vmware/lib/security/cacerts_backup
  1. Import the AD certificate 

keytool -import -alias <alias> -file <cert-file> -keystore cacerts -storepass changeit 

image.png

  1. Repeat steps 1-3 on all other nodes in the cluster


Additional Information

Impact/Risks:

Unable to login to Log Insight using the AD account after the AD certificate change