System Truststore and Keytab Maintenance

You can use the vCloud API to upload and manage SSL certificates, keystores, and Kerberos keytabs for the system LDAP and AMQP services. You can also use the vCloud API to configure SSPI, the Microsoft Security Support Provider Interface, for use with Active Directory.

Valid SSL certificates and truststores are required if the system LDAP and AMQP services use the secure sockets layer (https).

The SystemSettings element contains several elements that enable the system administrator to maintain certificates and truststores for the system LDAP and AMQP services. Links in the LdapSettings element allow the system administrator to manage the system LDAP truststore and keystore.

<SystemSettings ... >
   ...
   <LdapSettings ... >
      ...
      <vcloud:Link
         rel="certificate:update"
         href="https://vcloud.example.com/api/admin/extension/settings/ldapSettings/action/updateLdapCertificate"
         type="application/vnd.vmware.admin.certificateUpdateParams+xml"/>
      <vcloud:Link
         rel="certificate:reset"
         href="https://vcloud.example.com/api/admin/extension/settings/ldapSettings/action/resetLdapCertificate"/>
      <vcloud:Link
         rel="keystore:update"
         href="https://vcloud.example.com/api/admin/extension/settings/ldapSettings/action/updateLdapKeyStore"
         type="application/vnd.vmware.admin.keystoreUpdateParams+xml"/>
      <vcloud:Link
         rel="keystore:reset"
         href="https://vcloud.example.com/api/admin/extension/settings/ldapSettings/action/resetLdapKeyStore"/>
      <vcloud:Link
         rel="keytab:update"
         href="https://vcloud.example.com/api/admin/extension/settings/ldapSettings/action/updateLdapSspiKeytab"
         type="application/vnd.vmware.admin.sspiKeytabUpdateParams+xml"/>
      <vcloud:Link
         rel="keytab:reset"
         href="https://vcloud.example.com/api/admin/extension/settings/ldapSettings/action/resetLdapSspiKeytab"/>
      ...
   </LdapSettings>
   ...
</SystemSettings>

The AmqpSettings element includes links that allow the system administrator to manage the system AMQP truststore and certificate.

<SystemSettings ... >
   ...
   <AmqpSettings>
      ...
      <vcloud:Link
         rel="certificate:update"
         href="https://vcloud.example.com/api/admin/extension/settings/amqp/action/updateAmqpCertificate"
         type="application/vnd.vmware.admin.certificateUpdateParams+xml"/>
      <vcloud:Link
         rel="certificate:reset"
         href="https://vcloud.example.com/api/admin/extension/settings/amqp/action/resetAmqpCertificate"/>
      <vcloud:Link
         rel="truststore:update"
         href="https://vcloud.example.com/api/admin/extension/settings/amqp/action/updateAmqpTruststore"
         type="application/vnd.vmware.admin.trustStoreUpdateParams+xml"/>
      <vcloud:Link
         rel="truststore:reset"
         href="https://vcloud.example.com/api/admin/extension/settings/amqp/action/resetAmqpTruststore"/>
      ...
   </AmqpSettings>
   ...
</SystemSettings>

All of these links implement similar operations. They either upload a new certificate, keytab, or keystore, or reset or remove an existing one. vCloud Director imposes limits on upload sizes.

Truststore, Certificate, and Keytab Upload Limits
Upload Type	Maximum Size in Megabytes
vCenter truststore	10
LDAP certificate	2
LDAP keystore	2
LDAP SSPI keytab	2
AMQP certificate	2
AMQP truststore	10

Prerequisites

This operation is restricted to system administrators.

Procedure

Determine whether the request requires a body.

Requests whose rel value includes the string reset do not require a body. For details about other request bodies, see the schema reference.

POST the request to the request URL.

Include the request body if one is required.

Take any action that the response requires.

The response to an update request includes an uploadLocation parameter whose value is a URL to which you can upload the certificate, keytab, or keystore with a PUT request. Requests whose rel value includes the string reset return a No Content response and require no further action.

Example: Upload an SSL Certificate for the System LDAP Service

This example uploads an SSL certificate whose size is 892 bytes. The first step obtains an upload URL by POSTing a CertificateUpdateParams element to the organization's settings/ldap/action/updateLdapCertificate URL.

Request:

POST: https://vcloud.example.com/api/admin/extension/settings/ldap/action/updateLdapCertificate
Content-type: application/vnd.vmware.admin.certificateUpdateParams+xml
...
<?xml version="1.0" encoding="UTF-8"?>
<CertificateUpdateParams
   fileSize="892"
   xmlns="http://www.vmware.com/vcloud/v1.5">
</CertificateUpdateParams>

The response contains an uploadLocation parameter whose value is a URL to which you can upload the certificate.

Response:

<CertificateUploadSocket
   xmlns="http://www.vmware.com/vcloud/v1.5"
   uploadLocation="https://vcloud.example.com/transfer/53bc1/ldapCertificate">
   <Task
      ...
      status="running"
      operation="Updating LDAP certificate"  
      ...
   </Task>
</CertificateUploadSocket>

To upload the certificate, make a PUT request to the uploadLocation URL and supply the certificate in the request body.

Request:

PUT https://vcloud.example.com/transfer/53bc1/ldapCertificate
Content-length: 892
  ...serialized contents of certificate...

EOF

Response:

200 OK