6.0.3

Option Description
--initcsr
Required for generating CSRs.
--privkey <key_file>
Name of the private key le.
--pubkey <key_file>
Name of the public key le.
--csrfile <csr_file>
File name for the CSR le to be sent to the CA provider.
--config <config_file>
Optional name of the conguration le. Defaults to
certool.cfg.
Example:
certool --initcsr --privkey=<filename> --pubkey=<filename> --csrfile=<filename>
certool --selfca
Creates a self-signed certicate and provisions the VMCA server with a self-signed root CA. Using this
option is one of the simplest ways to provision the VMCA server. You can instead provision the VMCA
server with a third-party root certicate so that VMCA is an intermediate CA. See “Use VMCA as an
Intermediate Certicate Authority,” on page 102.
This command generates a certicate that is predated by three days to avoid time zone conicts.
Option Description
--selfca
Required for generating a self-signed certicate.
--predate <number_of_minutes>
Allows you to set the Valid Not Before eld of the root
certicate to the specied number of minutes before the
current time. This option can be helpful to account for
potential time zone issues. The maximum is three days.
--config <config_file>
Optional name of the conguration le. Defaults to
certool.cfg.
--server <server>
Optional name of the VMCA server. By default, the
command uses localhost.
Example:
machine-70-59:/usr/lib/vmware-vmca/bin # ./certool --predate=2280 --selfca --server= 192.0.2.24
--srp-upn=[e-mail]
certool --rootca
Imports a root certicate. Adds the specied certicate and private key to VMCA. VMCA always uses the
most recent root certicate for signing, but other root certicates remain available. That means you can
update your infrastructure one step at a time, and nally delete certicates that you no longer use.
Option Description
--rootca
Required for importing a root CA.
--cert <certfile>
Optional name of the conguration le. Defaults to
certool.cfg.
Chapter 3 vSphere Security Certificates
VMware, Inc. 121