5.3

Secure Communications Certificates
VCM uses Transport Layer Security (TLS) to secure all HTTP communication with Windows and UNIX
Agents in HTTP mode (includes all UNIX Agents and Windows Agents in HTTP mode). TLS uses
certificates to authenticate the Collector and Agents to each other. You must specify certificates for the
Collector and for the Enterprise during the installation process. If you plan to use your own certificates,
familiarize yourself with the certificate names so that you can select them during installation.
To be valid, a Collector certificate must meet the following criteria:
n
The Collector certificate must be located in the local machine personal certificate store.
n
The Collector certificate must be valid for Server Authentication. If any Enhanced Key Usage extension
or property is present, it must include the Server Authentication OID 1.3.6.1.5.5.7.3.1. If the Key Usage
extension is present, it must include DIGITAL_SIGNATURE.
n
The Collector certificate must not be expired.
If you want Installation Manager to generate the Collector and Enterprise certificates for you, select the
Generate option during installation.
NOTE If you will be installing more than one Collector that will communicate with the same Agent(s), or
you plan to replace/renew your certificates at a later date, there are special considerations for generating
and selecting certificates in VCM Installation Manager. For more information about VCM and Transport
Layer Security (TLS), see Transport Layer Security Implementation for VCM.
Server Authentication
Server Authentication is a method of authenticating the server to the client. VCM supports server
authentication. In VCM environments where TLS is employed, VCM Agents verify the identity of the
Collector (or Collectors) through the use and verification of certificates (over HTTP).
Typically, the server authenticates a client/user by requiring information, such as a user name and
password. When server authentication is used, the client/user verifies that the server is valid. To
accomplish this verification using TLS, the server provides a certificate issued by a trusted authority, such
as Verisign®. If your client web browser has the Verisign® Certified Authority certificate in its trusted
store, it can trust that the server is actually the web site you are accessing.
TLS uses certificates managed by a public key infrastructure (PKI) to guarantee the identity of servers and
clients. A certificate is a package containing a public key and information that identifies the owner and
source of that key, and one or more certifications (signatures) verifying that the package is authentic. To
sign a certificate, an issuer adds information about itself to the information already in the certificate
request. The public key and identifying information are hashed and signed using the private key of the
issuer’s certificate.
Certificates are defined by the X.509 RFC standard, which includes fields that form a contract between the
creator and consumer. The Enhanced Key Usage extension specifies the use for which the certificate is
valid, including Server Authentication.
Enterprise and Collector Certificates
An Enterprise Certificate and one or more Collector Certificates enable secure HTTP Collector-Agent
communication in VCM. The Enterprise Certificate enables VCM to operate in a multi-Collector
environment. Agents have the Enterprise Certificate in their trusted certificate stores, which they use
implicitly to validate any certificate issued by the Enterprise Certificate. All Collector Certificates are
expected to be issued by the Enterprise Certificate, which is critical in environments where a single Agent
Preparing for Installation
VMware, Inc. 15