Generating a Certificate Signing Request for VMware Aria Operations for logs 8.x

Products

• VCF Operations

Issue/Introduction

This article provides step-by-step instructions to generate a Certificate Signing Request (CSR) in in VMware Aria Operations for logs 8.x

Environment

VMware Aria Operations for logs 8.x

Resolution

To generate a CSR, follow the steps below on your primary node:

1. Log into the Primary node as root via SSH or the VM Console.
2. Run the following command to create the /cert directory and change to that directory:

   mkdir /cert && cd /cert

3. In the /cert directory, create and open a new configuration file called aol.cnf:

   vi /cert/aol.cnf

4. Copy and paste the following contents into the file (this configuration is tailored for a 3-node cluster). Update the CN and the specific node DNS/IP addresses to match your environment:

   [req]
   prompt = no
   distinguished_name = dn
   req_extensions = ext
   default_bits = 2048
   default_md = sha256
   encrypt_key = no
   
   [dn]
   CN = <Primary-node-FQDN-or-IP>
   
   [ext]
   subjectAltName = @alt_names
   
   [alt_names]
   DNS.1 = Primary_Node_FQDN
   DNS.2 = Node_2_FQDN
   DNS.3 = Node_3_FQDN
   DNS.4 = Primary_Node_Shortname
   DNS.5 = Node_2_Shortname
   DNS.6 = Node_3_Shortname
   IP.1 = Primary_Node_IP
   IP.2 = Node_2_IP
   IP.3 = Node_3_IP

   Note: Replace the CN value with VIP FQDN/IP if LB is configured.

5. Save and close the file:

   :wq!

    

6.  Using the aol.cnf file you just created, run the following openssl command to generate the private key and the CSR to send to your Certificate Authority:

   openssl req -new -config /cert/aol.cnf -keyout /cert/aol.key -out /cert/aol.csr

7. Verify that the information within the generated CSR is correct by running:

   openssl req -in /cert/aol.csr -noout -text

    

8. Once verified, you can provide the generated /cert/aol.csr file to your internal or external Certificate Authority (CA) to request the new signed certificate.