VMware vCenter 5.1 Installation: Part 8 (Install Web Client)

UPDATE 1/29/2013: Added additional steps per KB article for re-configuring the keystore, required when implementing trusted SSL certificates. References to 5.1.0b are also made, where appropriate, and other minor tweaks.
--

In Part 7 of this series we installed vCenter Server 5.1.0b. Now that vCenter Server installed, we need to proceed to getting the vSphere Web Client installed and configured. If you want to start back at part one of this vCenter 5.1 install series, you can find it here.

The web client has come a long ways since vCenter 5.0. It is now the primary means to manage your vSphere 5.x servers and vCenter 5.x instances (does not manage vSphere 4.x or 3.x). In fact, nearly all new vSphere 5.1 features are ONLY exposed through the web client, such as VM hardware version 9 and new dVS features.

The Windows C# vSphere client is a dodo bird in the making, and will die off in vSphere v.Next. However, the web client requires all new plug-ins (such as those from server/storage vendors), and VMware did not migrate VUM to the vSphere web client. So to manage/configure/use VUM you still need to use the traditional C# vSphere client. Vendors such as HP and Cisco will release updated plug-ins later in 2012.

This installation process is fairly easy and quick, so let's get started!

1. If you wish to save yourself some headache, you can pre-stage your trusted SSL certificate to the Web Client SSL directory, so that upon installation it will automatically use your new certificate without any further work. If you used my pre-stage script from earlier in this series, you are already good to go. If you are doing this manually, then from your D:\Certs\WebClient directory copy the rui.key, rui.crt and rui.pfx files to:

C:\ProgramData\VMware\vSphere web client\ssl

If you have already installed the Web Client, or wish to manually replace the certificates you can check out Part 14.

2. Start the vSphere Web Client installation wizard from the main menu.

3. Click through the wizard until you get to the SSO logon screen. Enter the credentials you created during the SSO installation process.

 

4. Wait for the installation process to complete. The services may take a few minutes to fully start, so I'd wait a little bit after the install completes to move on to the next step.

 

5. To administer vCenter locally via the web client you need Adobe Flash. Yes, one of the most vulnerability ridden pieces of software needs to be installed on your server (for local access). Install the latest version of Adobe flash.

 

6. If you have any vCenter 5.0 (not 5.1) instances that you want the Web Client to manage, they require manual registration with the web client. The vCenter 5.1 instance you just installed will automatically be discovered and requires NO further configuration. If you don't need to register any vCenter 5.0 instances, skip to step 7.

 

     A. Launch the vSphere Web Client Administration tool.

 

 

 

     B. Acknowledge the SSL error, then you should be presented with a web page showing a warning that no vCenter 5.0 systems registered. Click on Register vCenter Server.

 

     C. Enter the FQDN of the vCenter 5.0 server as shown below in the first field (e.g. D001VCTR01.contoso.net). If during the registration process you get a SSL certificate warning just accept it. For the vSphere web client server name enter the FQDN of your vCenter 5.1 server (assuming the web client is installed on your vCenter 5.1 server).

 

 

7. Launch the VMware vSphere Web Client from the start menu but DO NOT login. If you look at the bottom left of the screen you can download the Client Integration Plug-in. I would recommend you download and install the client, so you can enable features such as Windows session credentials to login to the web client. Unfortunately the IE plug-in won't work if your browser uses the more secure Protected Mode. So if you want increased security, don't bother with the plug-in.

 

Also, the Web Browser shortcut in the Start menu will cause a SSL validation problem since it uses "Localhost" instead of the FQDN. Once IE opens, modify the URL to use the FQDN then bookmark the page and forget about launching the web client from the start menu.

 

 



 

8. Once the plug-in is installed you can now use your Windows session credentials to login. Do NOT login as the SSO account if you want to see your vCenter 5.1 servers. You must login with an account that is a member of the vCenter admin group. Validate that your vCenter 5.1 server is listed.

 

 

 

Update SSO Keystore

 

1. Login to the Web Client using the admin@system-domain account and your master password.

 

2. Go to Administration -> Sign-On and Discovery -> Configuration. Click on the STS Certificate tab.

 

3. Click on the Edit button then you need to navigate to the directory below and select the root-trust.jks file.

 

C:\Program Files\VMware\Infrastructure\SSOServer\Security

 

4. Enter the keystore password "testpassword". You should now see at least two entries in your keystore (more if you have intermediary CAs.)

 

 

 

5. Select the chain alias (rui) then click OK. Re-enter the password "testpassword".

 

6. Reboot the server, so that all services recognize the new certificate chain.

 

7. After the server reboots, and you wait a few minutes for all the services to start up, log back into the web client and review the certificates listed under the STS Certificate tab. You should now see two chains. One chain has an issuer of RSA Identity (the self-signed certs) and the other chain should reflect your CA infrastructure.

 

 

 

You can now proceed to Part 9, where I show you a couple of SSO configuration tweaks most people will want to make.