VCenter Security certificates

Options available for replacing vCenter Server Security Certificates

A. Replace with certificates signed by the VMCA

B. Make VMCA an ICA

C. Use your own Certificates ( do not use VMCA)

Scenarios:

A. Replace existing VMCA-signed certificates with new VMCA signed certificates

is needed when root certifcate expires ( 10 y  default)

can be performed  only by administrator@vsphere.local or member of CAAdmins local group

you need to use vSphere Certificate Manager

Steps:

1.Generate a New VMCA-Signed Root Certificate

using certool CLI and then publish them to vmdir

2.Replace Machine SSL Certificates with VMCA-Signed Certificates 

3.Replace Solution User Certificates With New VMCA-Signed Certificates

4.Replace the VMware Directory Service Certificate in Mixed Mode Environments

B. Use VMware Certificate Authority  as an intermediate Certificate authority 

You can replace the VMCA root certificate with a certificate that is signed by an enterprise CA or third-party CA. VMCA signs the custom root certificate each time it provisions certificates, making VMCA an intermediate CA.

Steps:

1.Replace the Root Certificate (Intermediate CA)

The first step in replacing the VMCA certificates with custom certificates is generating a CSR and adding the certificate that is returned to VMCA as a root certificate.

2.Replace Machine SSL Certificates (Intermediate CA)

After you have received the signed certificate from the CA and made it the VMCA root certificate, you can replace all machine SSL certificates. These steps are essentially the same as the steps for replacing with a certificate that uses VMCA as the certificate authority. However, in this case, VMCA signs all certificates with the full chain. 

3.Replace Solution User Certificates (Intermediate CA)

You replace the machine solution user certificate on each management node and on each Platform Services Controller node. 

You replace the other solution user certificates only on each management node. Use the --server parameter to point to the Platform Services Controller when you run commands on a management node with an external Platform Services Controller. 

4.Replace the VMware Directory Service Certificate

If you decide to use a new VMCA root certificate, and you unpublish the VMCA root certificate that was used when you provisioned your environment, you must replace the machine SSL certificates, solution user certificates, and certificates for some internal services. If you unpublish the VMCA root certificate, you must replace the SSL Signing Certificate that is used by vCenter Single Sign-On.

You must also replace the VMware Directory Service (vmdir) certificate. 

5.Replace the VMware Directory Service Certificate in Mixed Mode Environments

C. Use your own Certificates ( do not use VMCA)

1 Request Certificates and Import a Custom Root Certificate

2 Replace Machine SSL Certificates With Custom Certificates

3 Replace Solution User Certificates With Custom Certificates

4 Replace the VMware Directory Service Certificate

5 Replace the VMware Directory Service Certificate in Mixed Mode Environments