6.0.3

Use VMCA as an Intermediate Certificate Authority
You can replace the VMCA root certicate with a third-party CA-signed certicate that includes VMCA in
the certicate chain. Going forward, all certicates that VMCA generates include the full chain. You can
replace existing certicates with newly generated certicates. This approach combines the security of third-
party CA-signed certicate with the convenience of automated certicate management.
Procedure
1 Replace the Root Certicate (Intermediate CA) on page 102
The rst step in replacing the VMCA certicates with custom certicates is generating a CSR and
adding the certicate that is returned to VMCA as a root certicate.
2 Replace Machine SSL Certicates (Intermediate CA) on page 104
After you have received the signed certicate from the CA and made it the VMCA root certicate, you
can replace all machine SSL certicates.
3 Replace Solution User Certicates (Intermediate CA) on page 106
After you replace the machine SSL certicates, you can replace the solution user certicates.
4 Replace the VMware Directory Service Certicate on page 110
If you decide to use a new VMCA root certicate, and you unpublish the VMCA root certicate that
was used when you provisioned your environment, you must replace the machine SSL certicates,
solution user certicates, and certicates for some internal services.
5 Replace the VMware Directory Service Certicate in Mixed Mode Environments on page 111
During upgrade, your environment might temporarily include both vCenter Single Sign-On version
5.5 and vCenter Single Sign-On version 6.0, you have to perform additional steps to replace the
VMware Directory Service SSL certicate if you replace the SSL certicate of the node on which the
vCenter Single Sign-On service is running.
Replace the Root Certificate (Intermediate CA)
The rst step in replacing the VMCA certicates with custom certicates is generating a CSR and adding the
certicate that is returned to VMCA as a root certicate.
The certicate that you send to be signed must meet the following requirements:
n
Key size: 2048 bits or more
n
PEM format. VMware supports PKCS8 and PKCS1 (RSA keys). When keys are added to VECS, they are
converted to PKCS8
n
x509 version 3
n
For root certicates CA extension must be set to true, and cert sign must be in the list of requirements.
n
Make sure that all nodes in your environment are time synchronized.
n
No explicit limit to the length of the certicate chain. VMCA uses the OpenSSL default, which is ten
certicates.
n
VMCA does not support using certicates with wildcards or more than one DNS name.
n
You cannot create subsidiary CAs of VMCA.
VMCA validates the following certicate aributes when you replace the root certicate:
n
Key size 2048 bits or more
n
Key Usage: Cert Sign
n
Basic Constraint: Subject Type CA
vSphere Security
102 VMware, Inc.