Enabling SSL in the CloudStack UI

Back up and edit /etc/cloud/management/server.xml. By default the HTTPS configuration is commented out, so uncomment it and update it as necessary. Note that Tomcat runs as the "cloud" user and not root, so an unprivileged port (1025/tcp or above) must be used and the keystore file will need appropriate permissions. Include the password you will use for the certificate

Modify server.xml

/etc/cloud/management/server.xml

Original file

/etc/cloud/management/server.xml

Modify and uncomment the 8443 port

Create SSL key

Obtain Certificate

· Follow your organization's standard procedures to generate and obtain a certificate suitable for securing a website. For example, generate a private key:

openssl genrsa 1024 > cloud.key

Generate a certificate signing request (CSR) with appropriate values:

openssl req -new -key cloud.key > cloud.csr

Submit the CSR to a certificate authority (for example, DigiNotar...) and get the

certificate, or generate a self-signed certificate as follows:

openssl x509 -req -in cloud.csr -signkey cloud.key > cloud.crt

Alternately, you can generate a CSR to have signed by a valid CA - implemention (for now) left as an exercise for the reader. Either way, the cert must be stored in a keystore, as described below.

Generate Keystore

· Create a PKCS12 format keystore using the private key and signed certificate:

openssl pkcs12 -export -in cloud.crt -inkey cloud.key -name cloud -passout pass:password > /usr/share/cloud-management/conf/cloud-localhost.pk12