6.0.3

Disabling remote access with authorized keys might limit your ability to run commands remotely on a host
without providing a valid login. For example, this can prevent you from running an unaended remote
script.
Certificate Management for ESXi Hosts
In vSphere 6.0 and later, the VMware Certicate Authority (VMCA) provisions each new ESXi host with a
signed certicate that has VMCA as the root certicate authority by default. Provisioning happens when the
host is added to vCenter Server explicitly or as part of installation or upgrade to ESXi 6.0 or later.
You can view and manage these certicates from the vSphere Web Client and by using the
vim.CertificateManager API in the vSphere Web Services SDK. You cannot view or manage ESXi certicates
by using certicate managment CLIs that are available for managing vCenter Server certicates.
Certificates in vSphere 5.5 and in vSphere 6.0
When ESXi and vCenter Server communicate, they use SSL for almost all management trac.
In vSphere 5.5 and earlier, the SSL endpoints are secured only by a combination of user name, password,
and thumbprint. Users can replace the corresponding self-signed certicates with their own certicates. See
the vSphere 5.5 Documentation Center.
In vSphere 6.0 and later, vCenter Server supports the following certicate modes for ESXi hosts.
Table 5‑1. Certificate Modes for ESXi Hosts
Certificate Mode Description
VMware Certicate Authority (default) Use this mode if VMCA provisions all ESXi hosts, either as
the top-level CA or as an intermediary CA.
By default, VMCA provisions ESXi hosts with certicates.
In this mode, you can refresh and renew certicates from
the vSphere Web Client.
Custom Certicate Authority Use this mode if you want to use only custom certicates
that are signed by a third-party CA.
In this mode, you are responsible for managing the
certicates. You cannot refresh and renew certicates from
the vSphere Web Client.
N Unless you change the certicate mode to Custom
Certicate Authority, VMCA might replace custom
certicates, for example, when you select Renew in the
vSphere Web Client.
Thumbprint Mode vSphere 5.5 used thumbprint mode, and this mode is still
available as a fallback option for vSphere 6.0. In this mode,
vCenter Server checks that the certicate is formaed
correctly, but does not check the validity of the certicate.
Even expired certicates are accepted.
Do not use this mode unless you encounter problems that
you cannot resolve with one of the other two modes. Some
vCenter 6.0 and later services might not work correctly in
thumbprint mode.
Certificate Expiration
Starting with vSphere 6.0, you can view information about certicate expiration for certicates that are
signed by VMCA or a third-party CA in the vSphere Web Client. You can view the information for all hosts
that are managed by a vCenter Server or for individual hosts. A yellow alarm is raised if the certicate is in
the Expiring Shortly state (less than 8 months). A red alarm is raised if the certicate is in the Expiration
Imminent state (less than 2 months).
vSphere Security
160 VMware, Inc.