Administer > NNMi Communications > Configure Communications > Configuring Communication for Virtual Environments > Configuring NNMi to Communicate with Hypervisors Using HTTPS

Configuring NNMi to Communicate with Hypervisors Using HTTPS

Note If you need to use HTTP to communicate with hypervisors, also see Enable HTTP to Communicate with Hypervisors.

To enable NNMi to monitor VMs hosted on a hypervisor (such as VMWare ESXi) using HTTPS protocol, you must upload the hypervisor’s trusted certificate to NNMi by using one of the following options:

  • Upload trusted certificate using NNMi user interface.
  • Upload trusted certificate by using command line interface (CLI).

Note A Trusted Certificate is an SSL certificate that NNMi uses to establish trusted connection with hypervisors using HTTPS protocol. At Default and Region levels, it is a CA certificate that NNMi uses to trust hypervisors that use the certificates issued by the same CA. At Node level, it is the hypervisor’s SSL certificate (self-signed or CA signed) generated by using FQDN as the subject name.

This section provides instructions to upload certificates by using the CLI. For upload instructions using NNMi user interface, see Help for Administrators > Configuring Communication Protocol.

To upload a trusted certificate to NNMi, follow these steps:

  1. Obtain the hypervisor's trusted certificate and copy it to a temporary location on the NNMi management server.

    Note VMware only. You must replace the VMware default certificate (localhost.localdomain) with a certificate that is generated using the hostname of the ESXi server. For more information, see the VMware documentation. For example steps to be followed on ESX5.1 and ESX5.5 servers, see Replacing the VMware Default Certificate

  2. Verify that the certificate is of the supported format. The supported trusted certificate file extensions are .pem, .crt, .cer and .der.

  3. Execute the appropriate command to upload the certificate at the required level. From the following table, choose the command that meets your requirements:

    Level Purpose Command

    Default (Global)

    To upload a trusted certificate at the default level for organizations that use certificates signed by the same CA on hypervisors globally.

    nnmcommunication.ovpl addCertificate -default -cert <fully qualified path to the certificate file>

    Region

    To upload a trusted certificate for the region for organizations that use certificates signed by the same CA on hypervisors in a given region.

    nnmcommunication.ovpl addCertificate -region <region name or UUID> -cert <fully qualified path to the certificate file>

    Node

    To upload an SSL certificate (CA or Self-Signed server certificate) used on a specific hypervisor.

    Note The self-signed or CA-signed certificate must be generated using the fully qualified domain name (FQDN) as the subject name.

    nnmcommunication.ovpl addCertificate -nodeSetting <node name or UUID> -cert <fully qualified path to the certificate file>

    Sample Commands:

    • Default: nnmcommunication.ovpl addCertificate -default -cert /tmp/new.pem
    • Region: nnmcommunication.ovpl addCertificate -region region1 -cert /tmp/region1.der
    • Node: nnmcommunication.ovpl addCertificate -nodeSetting node1 -cert /tmp/node1.crt
  4. Upon successful execution, the command output displays information about the uploaded certificate. Verify the certificate information.

Tip  

  • You can view or delete the uploaded certificates by using listCertificates and removeCertificate commands. See the nnmcommunication.ovpl reference page or Linux manpage for more information.
  • After a hypervisor is discovered, you can upload, replace, or delete a certificate directly on the Web Agent by using the command updateWebagentSettings. See the nnmcommunication.ovpl reference page or Linux manpage for more information.

Send Help Center feedback