Generate and install an SSL certificate for the VM Access Proxy

Title

When you install the Commander VM Access Proxy, a self-signed SSL certificate is created for its Tomcat web server. While this certificate enables secure communication, web browsers will prompt users to trust it manually because it is not validated by a certificate authority (CA). To avoid trust prompts and ensure seamless security, you can replace the default certificate with a CA-signed certificate using the procedure below.

Important version notes

For VM Access Proxy 2.10 and earlier, references use tomcat7.
For VM Access Proxy 2.11 and later, replace tomcat7 in paths and commands with tomcat, and substitute tomcat8 for services.

Remove the default self-signed certificate

Log in to the console proxy appliance:
- Username: vcommander
- Password: gRHrB211
Navigate to the directory:
```
cd /var/lib/tomcat7/conf
```

Delete the certificate:

sudo keytool -delete -alias tomcat -keystore "keystore" -storepass changeit

Enter the root password when prompted.

Confirm deletion:

keytool -list -v -keystore "keystore" -storepass changeit

Important: If the Tomcat service was stopped before this step, do not restart until a new certificate is installed.

Generate a new self-signed certificate

In the same directory, run the command:

sudo keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 3650 -keystore "keystore" -storepass changeit

Enter the root password when prompted and provide certificate details:
- First and Last Name: FQDN of the Access Proxy server
- Organizational Unit: Department name
- Organization: Organization name
- City, State, Country Code as applicable
For Key Password, press ENTER to skip.

Verify one entry exists:

keytool -list -v -keystore "keystore" -storepass changeit

The Tomcat service can now be restarted without error.

Create a certificate signing request (CSR)

Issue one of these commands:

VM Access Proxy 2.11 and later:

sudo keytool -certreq -keyalg RSA -alias tomcat -file tkproxy2017.csr -keystore "keystore" -ext san=dns:localhost,dns:your.address.one,dns:your.address.two,ip:127.0.0.1,ip:10.10.20.123 -storepass changeit

Replace DNS and IP values with those for your environment.

VM Access Proxy 2.10 and earlier:

sudo keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore "keystore" -storepass changeit

Start SSH service:
```
sudo service ssh start
```
Use FileZilla (SFTP) to connect and transfer the CSR file:
- Hostname: Console Proxy
- Protocol: SFTP
- Username: vcommander
- Password: gRHrB211
Navigate to /var/lib/tomcat7/conf in Remote site and download certreq.csr.
Submit this file to a certificate authority or Active Directory Certificate Services.

Import CA-signed certificates

Upload the returned certificate file (e.g., certnew.p7b) via FileZilla to /home/vcommander.
Log in to the console proxy appliance and install mTools:
```
sudo apt-get install mtools
```
Copy the certificate into the Tomcat config directory using:
```
sudo mcopy certnew.p7b /var/lib/tomcat7/conf
```
Navigate to the directory:
```
cd /var/lib/tomcat7/conf
```

Import the certificate:

sudo keytool -import -trustcacerts -alias tomcat -file certnew.p7b -keystore "keystore" -storepass changeit

Confirm import with Yes.

Important: If you receive a java.io.EOFException error, remove trailing spaces from the certificate in a text editor and retry.

Reset the connection in Commander

Go to Configuration > System Configuration.
Switch to the Integration tab.
Under Console Proxy, click Edit, then OK.

Commander will now communicate securely using the installed certificate.

Outcome

The VM Access Proxy is configured with a CA-signed SSL certificate, eliminating browser trust warnings and enabling secure remote session access.

Was this helpful?

Support Hub

Product

Snow Commander

Solution Area

Initial Configuration

Version

6.x

Visibility

Guest

URL Name

generatingandinstallingansslcertificateforthevmaccessproxy2x

Are you sure you want to cancel the case creation?

Case closed successfully

Action performed successfully

Upload Attachment

Maximum file size allowed is 3 MB.

File type not supported.

Supported file types:

Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Are you sure you want to close this case

Get Hotline support

Products	Region	Phone Numbers
FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield	North America *	+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America)
	Europe *	+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe)
	Japan *	+81 3-4540-5335 (select option 2)
	Australia *	+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics) Compliance Intelligence	Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.

Revenera Assistant