6.0.3

Replacing ESXi SSL Certificates and Keys
Your company's security policy might require that you replace the default ESXi SSL certicate with a third-
party CA-signed certicate on each host.
By default, vSphere components use the VMCA-signed certicate and key that are created during
installation. If you accidentally delete the VMCA-signed certicate, remove the host from its vCenter Server
system, and add it back. When you add the host, vCenter Server requests a new certicate from VMCA and
provisions the host with it.
Replace VMCA-signed certicates with certicates from a trusted CA, either a commercial CA or an
organizational CA, if company policy requires it.
The default certicates are in the same location as the vSphere 5.5 certicates. You can replace the default
certicates with trusted certicates in a number of ways.
N You can also use the vim.CertificateManager and vim.host.CertificateManager managed objects in
the vSphere Web Services SDK. See the vSphere Web Services SDK documentation.
After you replace the certicate, you have to update the TRUSTED_ROOTS store in VECS on the
vCenter Server system that manages the host to ensure that the vCenter Server and the ESXi host have a
trust relationship.
n
Requirements for ESXi Certicate Signing Requests on page 168
If you want to use a third-party CA-signed certicate, either with VMCA as a subordinate authority or
with a custom certicate authority, you have to send a Certicate Signing Request (CSR) to the CA.
n
Replace the Default Certicate and Key from the ESXi Shell on page 169
You can replace the default VMCA-signed ESXi certicates from the ESXi Shell.
n
Replace a Default Certicate and Key With the vifs Command on page 169
You can replace the default VMCA-signed ESXi certicates with the vifs command.
n
Replace a Default Certicate Using HTTPS PUT on page 170
You can use third-party applications to upload certicates and key. Applications that support HTTPS
PUT operations work with the HTTPS interface that is included with ESXi.
n
Update the vCenter Server TRUSTED_ROOTS Store (Custom Certicates) on page 170
If you set up your ESXi hosts to use custom certicates, you have to update the TRUSTED_ROOTS store on
the vCenter Server system that manages the hosts.
Requirements for ESXi Certificate Signing Requests
If you want to use a third-party CA-signed certicate, either with VMCA as a subordinate authority or with
a custom certicate authority, you have to send a Certicate Signing Request (CSR) to the CA.
Use a CSR with these characteristics:
n
2048 bits
n
PKCS1
n
No wildcards
n
Start time of one day before the current time
n
CN (and SubjectAltName) set to the host name (or IP address) that the ESXi host has in the
vCenter Server inventory.
vSphere Security
168 VMware, Inc.