Prerequisites for Running the Horizon Universal Console's Upload Pod Certificate Workflow to Configure SSL Certificates on the Horizon Cloud Pod's Manager VMs

Before you run the Upload Pod Certificate workflow, verify that you have satisfied these prerequisites. You must have the certificate-related files as described below to satisfy the Upload Pod Certificate window's criteria and allow the workflow to successfully complete.

Attention: Use of SHA-1 hashing function for these certificates is unsupported.

DNS Server

In your DNS server, map a fully qualified domain name (FQDN) to the IP address that is displayed in the pod's details page and which is labeled as Pod Manager Load Balancer IP. You can navigate to the pod's details page from the Capacity page and clicking on the pod's name.

For the meaning of the IP address that is displayed next to the label Pod Manager Load Balancer IP, see Overview of Configuring SSL Certificates on the Horizon Cloud Pod's Manager VMs, Primarily For Use By the Access Connector with Pods in a Single-Pod Broker Environment.

You use this FQDN when you obtain the SSL certificate files, as described in the following section.

SSL Certificate Files

The console's Upload Pod Certificate window requires you to provide three distinct, inter-related files.

The following screenshot is an illustration of how the Upload Pod Certificate window looks where you provide the three files.

The following list describes the files, related to the labels used in the console window, as depicted above.

• CA Certificate File (CA.crt)

  This CA.crt file is issued by a Certificate Authority (CA). This file is used to verify the authenticity of the other two files described below.

• SSL Certificate File (SSL.crt)

  This file is a public key file used for encryption of data using RSA encryption algorithm. The pod manager instances use this SSL.crt file to encrypt the data sent by the pod manager instances, in the scenario of using single-pod broker and the Access connector communicating with the pod managers. Refer to Overview of Configuring SSL Certificates on the Horizon Cloud Pod’s Manager VMs.

• SSL Key File (.key)

  This file is a private key file used for decryption of the data encrypted by the above SSL.crt public key file, using RSA encryption algorithm.

File Requirements

Ensure that the files meet the following requirements.

• The valid trusted SSL certificates are based on the FQDN that you mapped in your DNS server to the pod managers' load balancer IP.

• The CA certificate file (CA.crt) and the SSL certificate file (SSL.crt) are in PEM format, which is a BASE64-encoded DER representation of an X.509 certificate. They must both have a .crt extension.

  The following block is an example of how the file contents would look.

  
  -----BEGIN CERTIFICATE----- 
  MIIFejCCA2KgAwIBAgIDAIi/MA0GCSqG 
  ............... 
  -----END CERTIFICATE-----
  
  

• The private key file (.key) is without a password or passphrase associated with it. The following block is an example of how the file contents would look:

  
  -----BEGIN RSA PRIVATE KEY -----
  MIIEpQIBAAKCAQEAoJmURboiFut+R34CNFibb9fjtI+cpDarUzqe8oGKFzEE/jmj
  ...................... 
  -----END RSA PRIVATE KEY-----
  
  

• The certificate files must use a hashing function newer than SHA-1. Use of SHA-1 certificates on the pod manager instances is unsupported.

• Review the following section of special considerations related to the CA certificate file and, if your CA certificate file is a chained root CA type, ensure the described requirements are met.

CA Certificate File - Special Considerations

The CA certificate file must be issued by a trusted Certificate Authority (CA).

As a result, the CA.crt file generation depends on which CA you use. For example, common CAs include DigiCert, Verisign, Google, among others.

Depending on the CA you use, they might provide one of these types:

• Single Root CA certificate

  In this type, the CA directly signs the certificate.

• Chained Root CA certificate

  In this type, there are one or more third-party intermediatory certificate authorities involved along with the Root Certificate Authority.

When your CA certificate file involves having one or more intermediatory certificate authorities, then the CA.crt file should contain the intermediate certificates and the root CA. The file should start with the intermediate certificates at the top, and have the root certificate at the bottom of the file.

Next Steps

For steps used to configure the SSL certificate on the pod's manager VMs, see Configure SSL Certificates Directly on the Pod Manager VMs, Such as When Integrating the Access Connector Appliance with the Horizon Cloud Pod in Microsoft Azure, So that Connector Can Trust Connections to the Pod Manager VMs.

If your pod manifest is lower than 3139.x, contact Horizon Cloud Support for guidance before performing the steps. Because uploading and saving incorrect or improperly formed SSL certificate files to the pod can result in loss of access to the pod, and because the service's default backup and restore requires a manifest of 3139.x or higher, it is important to contact Horizon Cloud Support for assistance if your pod manifest is lower than 3139.x before running the Upload Pod Certificate workflow.