6.0.3

5 Replace the existing certicate in vmdir and then in VECS.
For solution users, you must add the certicates in that order. For example:
dir-cli service update --name <vpxd-xxxx-xxx-7c7b769cd9f4> --cert ./vpxd.crt
vecs-cli entry delete --store vpxd --alias vpxd
vecs-cli entry create --store vpxd --alias vpxd --cert vpxd.crt --key vpxd.priv
N Solution users cannot log in to vCenter Single Sign-On if you don't replace the certicate in
vmdir.
6 Restart all services.
service-control --start --all
Example: Replacing Solution User Certificates (Intermediate CA)
1 Generate a public/private key pair for each solution user. That includes a pair for the machine solution
user on each Platform Services Controller and each management node and a pair for each additional
solution user (vpxd, vpxd-extension, vsphere-webclient) on each management node.
a Generate a key pair for the machine solution user of an embedded deployment or for the machine
solution user of the Platform Services Controller.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --genkey --privkey=machine-
key.priv --pubkey=machine-key.pub
b (Optional) For deployments with an external Platform Services Controller, generate a key pair for
the machine solution user on each management node.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --genkey --privkey=machine-
key.priv --pubkey=machine-key.pub
c Generate a key pair for the vpxd solution user on each management node.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --genkey --privkey=vpxd-
key.priv --pubkey=vpxd-key.pub
d Generate a key pair for the vpxd-extension solution user on each management node.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --genkey --privkey=vpxd-
extension-key.priv --pubkey=vpxd-extension-key.pub
e Generate a key pair for the vsphere-webclient solution user on each management node.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --genkey --privkey=vsphere-
webclient-key.priv --pubkey=vsphere-webclient-key.pub
2 Generate solution user certicates that are signed by the new VMCA root certicate for the machine
solution user on each Platform Services Controller and each management node and for each additional
solution user (vpxd, vpxd-extension, vsphere-webclient) on each management node.
N The --Name parameter has to be unique. Including the name of the solution user store, for
example vpxd or vpxd-extension makes it easy to see which certicate maps to which solution user.
a Run the following command on the Platform Services Controller node to generate a solution user
certicate for the machine solution user on that node.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --gencert --cert=new-
machine.crt --privkey=machine-key.priv --Name=machine
b Generate a certicate for the machine solution user on each management node.
C:\>"C:\Program Files\VMware\vCenter Server\vmcad\"certool --gencert --cert=new-
machine.crt --privkey=machine-key.priv --Name=machine --server=<psc-ip-or-fqdn>
vSphere Security
108 VMware, Inc.