vCloud Usage Meter with Signed SSL Certificates

vCloud Usage Meter is a small virtual appliance used by service providers to measure their VMware product consumption for VSPP (VMware Service Provider Program) type licensing.

I needed to replace the self signed certificate of the web user interface. While there is a KB article 2047572 and also a chapter in the user guide dedicated to the subject neither was correct for my version 3.3.1 installation.

The web interfaces is provided by tc server which stores its certificate keystore in the following location:

/usr/local/tcserver/vfabric-tc-server-standard/um/conf/tcserver.jks

The keystore password is silverpen and the certificate alias is um. The location and password can be changed by editing server.xml in the same directory.

Here is a quick guide how to generate and sign new certificate with java keytool. Note if you need to generate private key externally use the steps described in my older article here.

1. Modify default path to include java keytool location:
   export PATH=$PATH:/usr/java/latest/bin 
2. Go to tc server conf folderd
   cd /usr/local/tcserver/vfabric-tc-server-standard/um/conf/ 
3. Backup current keystore
   mv tcserver.jks tcserver.jks.backup 
4. Generate private key. When asked always use password silverpen
   keytool -genkey -alias um -keyalg RSA -keysize 2048 -keystore tcserver.jks 
5. Modify ownership of the keystore file:
   chown usgmtr tcserver.jks 
6. Create certificate signing request
   keytool -certreq -alias um -keyalg RSA -file vcum.csr -keystore tcserver.jks 
7. Sign CSR with your CA (save certificate as vcum.crt)
8. Import root (and optionally intermediate) certificates if needed
   keytool -import -trustcacerts -alias root -file fojta-dc-CA.cer -keystore tcserver.jks 
9. Import the signed certificate
   keytool -import -alias um -file vcum.crt -keystore tcserver.jks 
10. Verify certificates were successfully imported into keystore
    keytool -list -keystore tcserver.jksKeystore type: JKS

    Keystore provider: SUN
    Your keystore contains 2 entries

    root, Aug 1, 2014, trustedCertEntry,
    Certificate fingerprint (MD5): E3:EE:7F:47:1A:3E:76:07:8F:27:5D:87:54:94:A4:E7
    um, Aug 2, 2014, PrivateKeyEntry,
    Certificate fingerprint (MD5): 26:3C:96:08:63:86:2B:E8:CA:2C:7F:53:6A:B2:EE:FA

11. Restart tc service
    service tomcat restart