[Users] replacing self-signed certificates

[Thomas Suckow]

I don't know about the native SPICE client, but here is what I did for 
apache and the websocket proxy:

In /etc/httpd/conf.d/ssl.conf it lists
SSLCertificateFile
SSLCertificateKeyFile
SSLCertificateChainFile
SSLCACertificateFile

Those are the files you need to replace for the web interface. My certs 
were combined, so I actually only use SSLCertificateFile and 
SSLCertificateChainFile

NOTE: If you modify ssl.conf, the path 
/etc/pki/ovirt-engine/apache-ca.pem is used by ovirt-iso-uploader. 
Uploads will fail unless you replace/symlink that file or specify a CA 
certificate on the command line. I actually linked to my chain file and 
it seems to be happy.



Websocket Proxy:

/etc/ovirt-engine/ovirt-websocket-proxy.conf.d/10-setup.conf defines the 
certificates.

The websocket proxy needs a combined certificate file with your cert and 
the entire chain for SSL_CERTIFICATE
SSL_KEY is just the unencrypted key, and it MUST be accessible by the 
ovirt user.



As for spice, I am not sure, I am guessing it is 
/etc/pki/ovirt-engine/keys/engine_id_rsa  and 
/etc/pki/ovirt-engine/keys/certs/engine.cer
Not sure where they are referenced except by the websocket proxy.

--
Thomas