<div dir="ltr">Hi Alon,<div><br></div><div>Thanks for your reply...but i didn't find 20-pki.conf file in my ovirt-engine server....</div><div><br></div><div>I am using websocket proxy as standalone....and fetch the vm console with the help of API...and then it will display to the browser with our portal url...</div>
<div><br></div><div>Thanks,</div><div>Punit</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Aug 14, 2014 at 11:13 PM, Alon Bar-Lev <span dir="ltr"><<a href="mailto:alonbl@redhat.com" target="_blank">alonbl@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br>
<br>
----- Original Message -----<br>
> From: "Punit Dambiwal" <<a href="mailto:hypunit@gmail.com">hypunit@gmail.com</a>><br>
> To: <a href="mailto:users@ovirt.org">users@ovirt.org</a>, <a href="mailto:ahadas@redhat.com">ahadas@redhat.com</a>, "Sven Kieske" <<a href="mailto:S.Kieske@mittwald.de">S.Kieske@mittwald.de</a>>, "Dan Kenigsberg" <<a href="mailto:danken@redhat.com">danken@redhat.com</a>>,<br>
> "Michal Skrivanek" <<a href="mailto:michal.skrivanek@redhat.com">michal.skrivanek@redhat.com</a>>, "Antoni Segura Puimedon" <<a href="mailto:asegurap@redhat.com">asegurap@redhat.com</a>>, "Frantisek Kobzik"<br>
> <<a href="mailto:fkobzik@redhat.com">fkobzik@redhat.com</a>>, "Itamar Heim" <<a href="mailto:iheim@redhat.com">iheim@redhat.com</a>>, "sabose" <<a href="mailto:sabose@redhat.com">sabose@redhat.com</a>>, <a href="mailto:barumuga@redhat.com">barumuga@redhat.com</a>, "Simone<br>
> Tiraboschi" <<a href="mailto:stirabos@redhat.com">stirabos@redhat.com</a>><br>
> Sent: Thursday, August 14, 2014 12:37:01 PM<br>
> Subject: Re: [ovirt-users] Ovirt SSL Question<br>
><br>
> Hi All,<br>
><br>
> Is there any one can help me to solve this issue..<br>
><br>
> Thanks,<br>
> Punit<br>
><br>
><br>
> On Wed, Aug 13, 2014 at 9:53 AM, Punit Dambiwal < <a href="mailto:hypunit@gmail.com">hypunit@gmail.com</a> > wrote:<br>
><br>
><br>
><br>
> Hi All,<br>
><br>
> I have one question regarding the SSL settings in Ovirt....let me explain my<br>
> environment first :-<br>
><br>
> 1. Ovirt engine :- <a href="http://mgmt.3linux.com" target="_blank">mgmt.3linux.com</a><br>
> 2. Standalone websocket proxy :- <a href="http://web-proxy.3linux.com" target="_blank">web-proxy.3linux.com</a><br>
> 3. Our Own Portal :- <a href="http://portal.3linux.com" target="_blank">portal.3linux.com</a><br>
><br>
> We have the above architecture...we fetch the VM console from the websocket<br>
> proxy to our own portal through API....because still we are using selfsigned<br>
> certificate...we need to trust the certificate every time,whenever we open<br>
> the VM console... (https://< <a href="http://web-proxy.3linux.com" target="_blank">web-proxy.3linux.com</a> >:<port>)<br>
><br>
> When we initiate the VM console through our own web portal the url (<br>
> <a href="https://portal.3linux.com/content/ovirt/noVNC/vm-console.php?id=6e0caf73-ae7d-493e-a51d-ecc32f507f00" target="_blank">https://portal.3linux.com/content/ovirt/noVNC/vm-console.php?id=6e0caf73-ae7d-493e-a51d-ecc32f507f00</a><br>
> ),if we accept the SSL certificate with https://< <a href="http://web-proxy.3linux.com" target="_blank">web-proxy.3linux.com</a><br>
> >:<port> ....then it will open as expected but if we didn't accept the<br>
> certificate manually...then it through failed to connect:1006 error...<br>
><br>
> We don't want that every time end user will accept the certificate<br>
> manually...as our link to open VM console is different then webproxy....<br>
><br>
> Now we want to replace the self signed certificate with valid SSL....can any<br>
> one tell me where we need to put the certificates and how to generate the<br>
> CSR for them and how many SSL we need to purchase to make this thing<br>
> workable without accepting the certificate everytime....<br>
<br>
</div></div>Create /etc/ovirt-engine/ovirt-websocket-proxy.conf.d/20-pki.conf and override the SSL_CERTIFICATE and SSL_KEY with 3rd party certificate chain and matching key.<br>
<br>
You can create the request in any tool you like, what we need is the certificate and key.<br>
<br>
Regards,<br>
Alon<br>
</blockquote></div><br></div>