Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Appendix D. Red Hat Virtualization and SSL

D.1. Replacing the Red Hat Virtualization Manager SSL/TLS Certificate

Warning

Do not change the permissions and ownerships for the /etc/pki directory or any subdirectories. The permission for the /etc/pki and the /etc/pki/ovirt-engine directory must remain as the default 755.
Use the following procedure(s) if you want to use your organization's third-party CA certificate to identify the Red Hat Virtualization Manager to users connecting over HTTPS.

Note

Using a third-party CA certificate for HTTPS connections does not affect the certificate used for authentication between the Manager and hosts. They will continue to use the self-signed certificate generated by the Manager.

Prerequisites

  • A third-party CA certificate. This is the certificate of the CA (Certificate Authority) that issued the certificate you want to use. It is provided as a PEM file. The certificate chain must be complete up to the root certificate. The chain's order is critical and must be from the last intermediate certificate to the root certificate. This procedure assumes that the third-party CA certificate is provided in /tmp/3rd-party-ca-cert.pem.
  • The private key that you want to use for Apache httpd. It must not have a password. This procedure assumes that it is located in /tmp/apache.key.
  • The certificate issued by the CA. This procedure assumes that it is located in /tmp/apache.cer.
If you received the private key and certificate from your CA in a P12 file, use the following procedure to extract them. For other file formats, contact your CA. After extracting the private key and certificate, proceed to Replacing the Red Hat Virtualization Manager Apache SSL Certificate.

Procedure D.1. Extracting the Certificate and Private Key from a P12 Bundle

The internal CA stores the internally generated key and certificate in a P12 file, in /etc/pki/ovirt-engine/keys/apache.p12. Red Hat recommends storing your new file in the same location. The following procedure assumes that the new P12 file is in /tmp/apache.p12.
  1. Back up the current apache.p12 file:
    Copy to Clipboard Toggle word wrap 
    # cp -p /etc/pki/ovirt-engine/keys/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12.bck
  2. Replace the current file with the new file:
    Copy to Clipboard Toggle word wrap 
    # cp /tmp/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12
  3. Extract the private key and certificate to the required locations. If the file is password protected, you must add -passin pass:password, replacing password with the required password.
    Copy to Clipboard Toggle word wrap 
    # openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /tmp/apache.key
# openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /tmp/apache.cer

Important

For new Red Hat Virtualization installations, you must complete all of the steps in this procedure. If you upgraded from a Red Hat Enterprise Virtualization 3.6 environment with a commercially signed certificate already configured, only steps 1, 8, and 9 are required.

Procedure D.2. Replacing the Red Hat Virtualization Manager Apache SSL Certificate

  1. Add your CA certificate to the host-wide trust store:
    Copy to Clipboard Toggle word wrap 
    # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ca-trust/source/anchors
     Copy to Clipboard Toggle word wrap 
    # update-ca-trust
  2. The Manager has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link:
    Copy to Clipboard Toggle word wrap 
    # rm /etc/pki/ovirt-engine/apache-ca.pem
  3. Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem:
    Copy to Clipboard Toggle word wrap 
    # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem
  4. Back up the existing private key and certificate:
    Copy to Clipboard Toggle word wrap 
    # cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.bck
# cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.bck
  5. Copy the private key to the required location:
    Copy to Clipboard Toggle word wrap 
    # cp /tmp/apache.key /etc/pki/ovirt-engine/keys/apache.key.nopass
  6. Copy the certificate to the required location:
    Copy to Clipboard Toggle word wrap 
    # cp /tmp/apache.cer /etc/pki/ovirt-engine/certs/apache.cer
  7. Restart the Apache server:
    Copy to Clipboard Toggle word wrap 
    # systemctl restart httpd.service
  8. Create a new trust store configuration file:
    Copy to Clipboard Toggle word wrap 
    # vi /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf
    Add the following content and save the file:
    Copy to Clipboard Toggle word wrap 
    ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""
  9. Restart the ovirt-engine service:
    Copy to Clipboard Toggle word wrap 
    # systemctl restart ovirt-engine.service
  10. Replacing the certificate can cause the log collector to fail. To prevent this, create a new log collector configuration file:
    Copy to Clipboard Toggle word wrap 
    # vi /etc/ovirt-engine/logcollector.conf.d/99-custom-ca-cert.conf
    Add the following content and save the file:
    Copy to Clipboard Toggle word wrap 
    [LogCollector]
cert-file=/etc/pki/ovirt-engine/apache-ca.pem
Your users can now connect to the Administration and User portals without being warned about the authenticity of the certificate used to encrypt HTTPS traffic.
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat, Inc.