Import a Certificate to the Orchestrator Trust Store using PEM-encoded file

vRealize Orchestrator server must be able to verify their identity, to communicate with other servers (vCenter Server, relational database management system (RDBMS), LDAP, Single Sign-On, and other servers) securely. For this purpose, you might need to import the SSL certificate of the remote entity to the Orchestrator trust store.

To trust a certificate, you can import it to the trust store either by establishing a connection to a specific URL, or directly as a PEM-encoded file.

Option	Description
Import from URL or proxy URL	The URL of the remote server: https://your_server_IP_address or your_server_IP_address:port
*Import from file*	Path to the PEM-encoded certificate file.

In this post, we will focus on how to import a certificate using PEM-encoded file. For URL based import, simply use the Library Workflows.

Step 1: Generate PEM file

Prerequisites

Find the fully qualified domain name of the server to which you want Orchestrator to connect over SSL.

Procedure

Log in to the Orchestrator Appliance over SSH as root.
Run a command to retrieve the certificate of the remote server.

openssl s_client -connect host_or_dns_name:secure_port

a If you use a nonencrypted port, use starttls and the required protocol with the openssl command.

openssl s_client -connect host_or_dns_name:port -starttls smtp

Copy the text from the -----BEGIN CERTIFICATE----- to the -----END CERTIFICATE----- tag to a text editor and save it as a file in your local system.

Step 2: Import a PEM-encoded file

We can use either of the following ways for this purpose.

Control Center
vRO Library Workflow

via Control Center

Log in to Control Center as root.
Go to the Certificates page.

On the Trusted Certificates tab, click Import and select the Import from a PEM-encoded file option.

Browse to the certificate file and click Import.

via vRO Workflow

Log in to vRO Portal.
Go to Workflows under Library > Configuration > SSL Trust Manager.
Run workflow Import a trusted certificate from a file

Browse to the certificate file and click Run.

The workflow should be successfully completed.

Results

You have successfully imported a remote server certificate to the Orchestrator trust store. You can check an entry for the corresponding server in the Control Center Certificates Tab or try running the workflow related to the server for which the certificate was imported. You won’t see this error anymore.