Generate Manually Key Pair and Certificate Singing Request for NSX in Region B

If you plan to generate manually a CA-signed certificate for NSX, you can generate a certificate signing request (CSR) and submit it to the CA for signing.

Procedure

1. Log in to the Windows host that has access to the AD server as an administrator.

2. On the Windows host that has access to the data center, log in to the NSX Manager Web interface.

   1. Open a Web browser and go to following URL. |NSX Manager|URL| |:----------|:--| |NSX Manager for the management cluster|https://mgmt01nsxm51.lax01.rainpole.local| |NSX Manager for the shared compute and edge cluster|https://comp01nsxm51.lax01.rainpole.local|

   2. Log in using the following credentials.

      Setting

      Value

      User name

      admin

      Password

      nsx_manager_admin_password

3. Click Manage Appliance Settings.

4. In the Settings pane on the left, click SSL Certificates.
5. Under SSL Certificates on the right, click Generate CSR.

6. In the Generate Certificate Signing Request dialog box, provide the following information, and click OK.

   CSR Info

   Value

   Algorithm

   RSA

   Key size

   2048

   Common Name

   • mgmt01nsxm51.lax01.rainpole.local

   • comp01nsxm51.lax01.rainpole.local

   Organization Unit

   Rainpole

   Organization Name

   Rainpole

   Locality Name

   LAX

   State Name

   CA

   Country Code

   US

7. Under SSL Certificates, click Download CSR.

   VMware NSX downloads a CSR file called NSX to the default download directory.

   

8. Copy the NSX file to the local following directory.

   Create the directory if necessary.

   |NSX Manager Instance|Directory on the Windows Host| |:-------------------|:----------------------------| |mgmt01nsxm51.lax01.rainpole.local|C:\manual-certs\nsx\mgmt01nsxm51.lax01| |mgmt01nsxm51.lax01.rainpole.local|C:\manual-certs\nsx\comp01nsxm51.lax01|

9. Rename the file adding the .csr extension at the end of the file name.

   NSX Manager

   File Name

   mgmt01nsxm51.lax01.rainpole.local

   mgmt01nsxm51.lax01_ssl.csr

   comp01nsxm51.lax01.rainpole.local

   comp01nsxm51.lax01_ssl.csr

What to do next

Obtain a signed certificate from the Microsoft certificate authority. See Generate CA-Signed Certificates for the SDDC Management Components in Region B .

Parent topic: Generate Manually Key Pairs and Certificate Signing Requests for the Management Components in Region B