You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+88-18Lines changed: 88 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,10 +38,11 @@ VMware vCenter uses certificates to secure communications between the different
38
38
39
39
40
40
### vCenter
41
-
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
42
41
42
+
The certificate store type of vCenter associated with this integration implements the Inventory, Management Add, and Management Remove job types.
43
43
44
-
TODO Overview is a required section
44
+
The Add and Remove operations have the ability to create and remove trusted root chains and SSL certificates associated with
45
+
VMware vCenter. The certificate type is automatically identified by the orchestrator. It does not manage ESXI host certificates.
45
46
46
47
## Compatibility
47
48
@@ -57,22 +58,12 @@ The VMware vCenter Universal Orchestrator extension If you have a support issue,
57
58
Before installing the VMware vCenter Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command.
58
59
59
60
60
-
### VMware vCenter Requirements
61
-
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
62
-
63
-
64
-
TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
65
-
66
-
67
-
68
61
69
62
## Create the vCenter Certificate Store Type
70
63
71
64
To use the VMware vCenter Universal Orchestrator extension, you **must** create the vCenter Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.
72
65
73
66
74
-
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
75
-
76
67
77
68
***Create vCenter using kfutil**:
78
69
@@ -178,22 +169,101 @@ TODO Global Store Type Section is an optional section. If this section doesn't s
178
169
## Defining Certificate Stores
179
170
180
171
181
-
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
182
172
183
-
TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
173
+
* **Manually with the Command UI**
174
+
175
+
<details><summary>Create Certificate Stores manually in the UI</summary>
176
+
177
+
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
178
+
179
+
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
180
+
181
+
2. **Add a Certificate Store.**
182
+
183
+
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
184
+
| Attribute | Description |
185
+
| --------- | ----------- |
186
+
| Category | Select "VMware vCenter" or the customized certificate store name from the previous step. |
187
+
| Container | Optional container to associate certificate store with. |
188
+
| Client Machine | The domain name of the vSphere client managing vCenter (url to vCenter host without the 'https://'. |
189
+
| Store Path | A unique identifier for this store. The actual value is unused by the orchestrator extension |
190
+
| Orchestrator | Select an approved orchestrator capable of managing `vCenter` certificates. Specifically, one with the `vCenter` capability. |
191
+
| ServerUsername | The vCenter username used to manage the vCenter connection |
192
+
| ServerPassword | The secret vCenter password used to manage the vCenter connection |
193
+
194
+
195
+
196
+
197
+
</details>
198
+
199
+
* **Using kfutil**
200
+
201
+
<details><summary>Create Certificate Stores with kfutil</summary>
202
+
203
+
1. **Generate a CSV template for the vCenter certificate store**
> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
188
232
189
233
190
-
## Discovering Certificate Stores with the Discovery Job
234
+
### vCenter Configuration
235
+
236
+
vCenter management is controlled by the vSphere client. Follow VMware's vCenter Server Configuration [documentation](https://docs.vmware.com/en/VMware-vSphere/7.0/vsphere-esxi-vcenter-server-703-configuration-guide.pdf) to configure a vSphere client and vCenter.
237
+
238
+
### Installing the extension
239
+
240
+
1. Stop the Orchestrator service if it is running.
241
+
1. Create a folder in your Orchestrator extensions directory called "vCenter"
242
+
1. Extract the contents of the release zip file into this folder.
243
+
1. Start the Orchestrator service.
191
244
192
-
### VMware vCenter Discovery Job
193
-
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
245
+
### vCenter Certificate Store Parameters
246
+
247
+
To create a new certificate store in Keyfactor Command, selectthe _Locations_ drop down, select_Certificate Stores_, and click the _Add_ button.
248
+
fill the displayed form with the following values:
| Category |'VMware vCenter'| The name of the VMware vCenter store type|
253
+
| Client Machine | vSphere Domain Name | The domain name of the vSphere client managing vCenter (ex: https://myvcenter.pki.local would use `myvcenter.pki.local`|
254
+
| Store Path |'vCenter Certificates'| The _StorePathValue_ of the vCenter instance as set during store type configuration |
255
+
| Server Username | Client secret Username | The secret vCenter username used to manage the vCenter connection |
256
+
| Server Password | Client Secret Password | The secret vCenter password used to manage the vCenter connection |
257
+
258
+
### Managing vCenter Certificates
259
+
260
+
This orchestrator extension allows managing both Trusted root certificates as well as SSL/TLS certificates.
194
261
262
+
:warning: _Important note on certificate enrollment_
195
263
196
-
TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
264
+
In order to enroll a new Trusted Root Certificate from the platform, follow the normal steps for enrolling a certificate into the certificate store, but do not include the private key.
265
+
- If the private key is omitted, the extension assumes we are replacing the Trusted Root Certificate.
266
+
- If the private key is included, the extension assumes we are replacing the TLS certificate used for SSL communication.
0 commit comments