Appendix E. Red Hat Virtualization and encrypted communication E.1. Replacing the Red Hat Virtualization Manager CA Certificate You can configure your organization's third-party CA certificate to authenticate users connecting to the Red Hat Virtualization Manager over HTTPS. Third-party CA certificates are not used for authentication between the Manager and hosts or for disk transfer URLs . These HTTPS connections use the self-signed certificate generated by the Manager. Important When you switch to a custom HTTPS certificate, you must use your own CA certificate distribution to make that certificate available on clients. If you are integrating with Red Hat Satellite, you need to manually import the correct certificate into Satellite. If you received the private key and certificate from your CA in a P12 file, use the following procedure to extract them. For other file formats, contact your CA. After extracting the private key and certificate, proceed to Replacing the Red Hat Virtualization Manager Apache CA Certificate . E.1.1. Extracting the Certificate and Private Key from a P12 Bundle The internal CA stores the internally generated key and certificate in a P12 file, in /etc/pki/ovirt-engine/keys/apache.p12 . Store your new file in the same location. The following procedure assumes that the new P12 file is in /tmp/apache.p12 . Warning Do not change the permissions and ownerships for the /etc/pki directory or any subdirectories. The permission for the /etc/pki and the /etc/pki/ovirt-engine directory must remain as the default, 755 . Procedure Back up the current apache.p12 file: # cp -p /etc/pki/ovirt-engine/keys/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12.bck Replace the current file with the new file: # cp /tmp/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12 Extract the private key and certificate to the required locations: # openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /tmp/apache.key # openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /tmp/apache.cer If the file is password protected, add -passin pass: password to the command, replacing password with the required password. Important For new Red Hat Virtualization installations, you must complete all of the steps in this procedure. E.1.2. Replacing the Red Hat Virtualization Manager Apache CA Certificate You configure your organization's third-party CA certificate to authenticate users connecting to the Administration Portal and the VM Portal over HTTPS. Warning Do not change the permissions and ownerships for the /etc/pki directory or any subdirectories. The permission for the /etc/pki and the /etc/pki/ovirt-engine directory must remain as the default, 755 . Prerequisites Third-party CA (Certificate Authority) certificate. It is provided as a PEM file. The certificate chain must be complete up to the root certificate. The chain's order is critical and must be from the last intermediate certificate to the root certificate. This procedure assumes that the third-party CA certificate is provided in /tmp/3rd-party-ca-cert.pem . Private key that you want to use for Apache httpd. It must not have a password. This procedure assumes that it is located in /tmp/apache.key . Certificate issued by the CA. This procedure assumes that it is located in /tmp/apache.cer . Procedure If you are using a self-hosted engine, put the environment into global maintenance mode. # hosted-engine --set-maintenance --mode=global For more information, see Maintaining the Self-Hosted Engine . Add your CA certificate to the host-wide trust store: # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ca-trust/source/anchors # update-ca-trust The Manager has been configured to use /etc/pki/ovirt-engine/apache-ca.pem , which is symbolically linked to /etc/pki/ovirt-engine/ca.pem . Remove the symbolic link: # rm /etc/pki/ovirt-engine/apache-ca.pem Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem : # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem Back up the existing private key and certificate: # cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.bck # cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.bck Copy the private key to the required location: # cp /tmp/apache.key /etc/pki/ovirt-engine/keys/apache.key.nopass Set the private key owner to root and set the permissions to 0640 : # chown root:ovirt /etc/pki/ovirt-engine/keys/apache.key.nopass # chmod 640 /etc/pki/ovirt-engine/keys/apache.key.nopass Copy the certificate to the required location: # cp /tmp/apache.cer /etc/pki/ovirt-engine/certs/apache.cer Set the certificate owner to root and set the permissions to 0644 : # chown root:ovirt /etc/pki/ovirt-engine/certs/apache.cer # chmod 644 /etc/pki/ovirt-engine/certs/apache.cer Restart the Apache server: # systemctl restart httpd.service Create a new trust store configuration file, /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf , with the following parameters: ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts" ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD="" Copy the /etc/ovirt-engine/ovirt-websocket-proxy.conf.d/10-setup.conf file, and rename it with an index number that is greater than 10 (for example, 99-setup.conf ). Add the following parameters to the new file: Restart the websocket-proxy service: # systemctl restart ovirt-websocket-proxy.service If you manually changed the /etc/ovirt-provider-ovn/conf.d/10-setup-ovirt-provider-ovn.conf file, or are using a configuration file from an older installation, make sure that the Manager is still configured to use /etc/pki/ovirt-engine/apache-ca.pem as the certificate source. Create the /etc/ovirt-engine-backup/engine-backup-config.d directory: # mkdir -p /etc/ovirt-engine-backup/engine-backup-config.d Create the /etc/ovirt-engine-backup/engine-backup-config.d/update-system-wide-pki.sh file with the following content. This enables ovirt-engine-backup to automatically update the system on restore. BACKUP_PATHS="USD{BACKUP_PATHS} /etc/ovirt-engine-backup" cp -f /etc/pki/ovirt-engine/apache-ca.pem \ /etc/pki/ca-trust/source/anchors/ 3rd-party-ca-cert .pem update-ca-trust Restart the ovirt-provider-ovn service: # systemctl restart ovirt-provider-ovn.service Restart the ovirt-imageio service: # systemctl restart ovirt-imageio.service Restart the ovirt-engine service: # systemctl restart ovirt-engine.service If you are using a self-hosted engine, turn off global maintenance mode: # hosted-engine --set-maintenance --mode=none Your users can now connect to the Administration Portal and VM Portal without seeing a certificate warning.

Commands:
cp -p /etc/pki/ovirt-engine/keys/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12.bck
cp /tmp/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12
openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /tmp/apache.key openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /tmp/apache.cer
hosted-engine --set-maintenance --mode=global
cp /tmp/3rd-party-ca-cert.pem /etc/pki/ca-trust/source/anchors update-ca-trust
rm /etc/pki/ovirt-engine/apache-ca.pem
cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem
cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.bck cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.bck
cp /tmp/apache.key /etc/pki/ovirt-engine/keys/apache.key.nopass
chown root:ovirt /etc/pki/ovirt-engine/keys/apache.key.nopass chmod 640 /etc/pki/ovirt-engine/keys/apache.key.nopass
cp /tmp/apache.cer /etc/pki/ovirt-engine/certs/apache.cer
chown root:ovirt /etc/pki/ovirt-engine/certs/apache.cer chmod 644 /etc/pki/ovirt-engine/certs/apache.cer
systemctl restart httpd.service
ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts" ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""
SSL_CERTIFICATE=/etc/pki/ovirt-engine/certs/apache.cer SSL_KEY=/etc/pki/ovirt-engine/keys/apache.key.nopass
systemctl restart ovirt-websocket-proxy.service
mkdir -p /etc/ovirt-engine-backup/engine-backup-config.d
BACKUP_PATHS="USD{BACKUP_PATHS} /etc/ovirt-engine-backup" cp -f /etc/pki/ovirt-engine/apache-ca.pem /etc/pki/ca-trust/source/anchors/ 3rd-party-ca-cert .pem update-ca-trust
systemctl restart ovirt-provider-ovn.service
systemctl restart ovirt-imageio.service
systemctl restart ovirt-engine.service
hosted-engine --set-maintenance --mode=none