6.0.3

Refresh the STS Root Certificate
The vCenter Single Sign-On server includes a Security Token Service (STS). The Security Token Service is a
Web service that issues, validates, and renews security tokens. You can manually refresh the existing
Security Token Service certicate from the vSphere Web Client when the certicate expires or changes.
To acquire a SAML token, a user presents the primary credentials to the Secure Token Server (STS). The
primary credentials depend on the type of user:
Solution user
Valid certicate
Other users
User name and password available in a vCenter Single Sign-On identity
source.
The STS authenticates the user using the primary credentials, and constructs a SAML token that contains
user aributes. The STS service signs the SAML token with its STS signing certicate, and then assigns the
token to a user. By default, the STS signing certicate is generated by VMCA.
After a user has a SAML token, the SAML token is sent as part of that user's HTTP requests, possibly
through various proxies. Only the intended recipient (service provider) can use the information in the
SAML token.
You can replace the existing STS signing certicate vSphere Web Client if your company policy requires it,
or if you want to update an expired certicate.
C Do not replace the le in the lesystem. If you do, errors that are unexpected and dicult to
debug result.
N After you replace the certicate, you must restart the node to restart both the vSphere Web Client
service and the STS service.
Prerequisites
Copy the certicate that you just added to the java keystore from the Platform Services Controller to your
local workstation.
Platform Services
Controller appliance
certificate_location/keys/root-trust.jks For example: /keys/root-
trust.jks
For example:
/root/newsts/keys/root-trust.jks
Windows installation
certificate_location\root-trust.jks
For example:
C:\Program Files\VMware\vCenter Server\jre\bin\root-trust.jks
Procedure
1 Log in to the vSphere Web Client as [e-mail] or as another user with vCenter Single
Sign-On administrator privileges.
Users with vCenter Single Sign-On administrator privileges are in the Administrators group in the
vsphere.local domain.
2 Select the  tab, then the STS Signing subtab, and click the Add STS Signing 
icon.
vSphere Security
50 VMware, Inc.