6.0.3

4 Publish the custom root certicat, which is the signing certicate from the third-party CA.
dir-cli trustedcert publish --cert <my_custom_root>
If you do not specify a user name and password on the command line, you are prompted.
5 Restart all services.
service-control --start --all
What to do next
You can remove the original VMCA root certicate from the certicate store if company policy requires it. If
you do, you have to refresh these internal certicates:
n
Replace the vCenter Single Sign-On Signing certicate. See “Refresh the STS Root Certicate,” on
page 50.
n
Replace the VMware Directory Service certicate. See “Replace the VMware Directory Service
Certicate,” on page 110.
Replace Machine SSL Certificates With Custom Certificates
After you receive the custom certicates, you can replace each machine certicate.
Each machine must have a machine SSL certicate for secure communication with other services. In a multi-
node deployment, you must run the Machine SSL certicate generation commands on each node. Use the --
server parameter to point to the Platform Services Controller from a vCenter Server with external
Platform Services Controller.
You must have the following information before you can start replacing the certicates:
n
Password for [e-mail].
n
Valid Machine SSL custom certicate (.crt le).
n
Valid Machine SSL custom key (.key le).
n
Valid custom certicate for Root (.crt le).
n
If you are running the command on a vCenter Server with external Platform Services Controller in a
multi-node deployment, IP address of the Platform Services Controller.
Prerequisites
You must have received a certicate for each machine from your third-party or enterprise Certicate
Authority.
n
Key size: 2048 bits or more (PEM encoded)
n
CRT format
n
x509 version 3
n
SubjectAltName must contain DNS Name=<machine_FQDN>
n
Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment
vSphere Security
114 VMware, Inc.