VMware VCM 5.3 - TRANSPORT LAYER SECURITY IMPLEMENTATION Manuale Utente Scaricare il pdf (Pagina 6)

TLS Implementation for VCM

TECHNICAL WHITE PAPER / 6

Note VCM supports certificate expiration. However, it does not support revocation lists. Certificates can be

removed from the certificate stores to effectively "revoke" them.

Certificate Standards

Certificates are defined by the X.509 RFC standard. This standard includes certain standard fields and capabilities.

Those who implement certificates may add additional fields, which can be marked as either critical or non-critical.

These fields are a contract between the creator and consumer. Because they are implementation-defined, an

application might encounter a certificate with fields that it does not understand. The application is obligated to fail

validation on a certificate with critical extensions that it does not understand. Non-critical extensions may be ignored.

One of the non-critical extensions is Enhanced Key Usage. This extension is used to specify the uses for which the

certificate is valid. These usages may include Server Authentication, Client Authentication, Code Signing, and

Certificate Signing.

Certificate Storage

In Microsoft® systems, certificates are stored in certificate stores. Certificate stores may be located in files, the

registry, memory, Active Directory, and other locations. Logical certificate stores provide a unified view of a collection

of physical stores that share common properties. All discussion of Microsoft certificate stores in this document refers

to logical stores. For a description of the logical system stores provided by Microsoft, see Microsoft TechNet:

Certificate Stores.

On UNIX systems, Collector Certificates (for Server Authentication) and Agent Certificates and Agent private keys

(for Mutual Authentication) are stored in a proprietary protected store. Although this store is not encrypted, it is

protected from simple viewing. Use the CSI_ManageCertificateStore utility and the associated help provided with your

VCM UNIX Agent installation package to view or manage the UNIX Agent Certificate store. For more information, see

the VMware vCenter Configuration Manager Installation and Getting Started Guide.

All VCM Agents using HTTP should be able to trust any VCM Collector Certificate, not just the Collector that the

Agent installation package was generated on. This may be via an Enterprise Certificate or through an existing PKI

system. If this environmental requirement is not met, only the Collector that generated the Agent installation package

(and any Collectors that share an Enterprise certificate with that Collector) will be able to communicate with the Agent

using the HTTP protocol. See How VCM Uses Certificates on page 7.

All VCM Collectors should be able to trust any Agent Certificate, even those issued by other Collectors. This may be

via an Enterprise Certificate or an existing PKI system. It this requirement is not met, the Collector will fail to establish

Mutual Authentication with Agents that are certified by another Collector.

1 2 3 4 5 6 7 8 9 10 11 ... 33 34

Nessun commento

VMware VCM 5.3 - TRANSPORT LAYER SECURITY IMPLEMENTATION Manuale Utente Pagina 6