6.0.3

Table 3‑2. Certificates in vSphere 6.0 (Continued)
Certificate Provisioned by Stored
vCenter Single Sign-On SSL
signing certicate
Provisioned during installation. Manage this certicate from the
vSphere Web Client.
Do not change this certicate in the lesystem or
unpredictable behavior results.
VMware Directory Service
(vmdir) SSL certicate
Provisioned during installation. In certain corner cases, you might have to replace
this certicate. See “Replace the VMware
Directory Service Certicate,” on page 110.
ESXi
ESXi certicates are stored locally on each host in the /etc/vmware/ssl directory. ESXi certicates are
provisioned by VMCA by default, but you can use custom certicates instead. ESXi certicates are
provisioned when the host is rst added to vCenter Server and when the host reconnects.
Machine SSL Certificates
The machine SSL certicate for each node is used to create an SSL socket on the server side to which SSL
clients connect. The certicate is used for server verication and for secure communication such as HTTPS
or LDAPS.
All services communicate through the reverse proxy. For compatibility, services that were available in earlier
versions of vSphere also use specic ports. For example, the vpxd service uses the MACHINE_SSL_CERT to
expose its endpoint.
Every node (embedded deployment, management node, or Platform Services Controller), has its own
machine SSL certicate. All services that are running on that node use this machine SSL certicate to expose
their SSL endpoints.
The machine SSL certicate is used as follows:
n
By the reverse proxy service on each Platform Services Controller node. SSL connections to individual
vCenter services always go to the reverse proxy. Trac does not go to the services themselves.
n
By the vCenter service (vpxd) on management nodes and embedded nodes.
n
By the VMware Directory Service (vmdir) on infrastructure nodes and embedded nodes.
VMware products use standard X.509 version 3 (X.509v3) certicates to encrypt session information that is
sent over SSL between components.
Solution User Certificates
A solution user encapsulates one or more vCenter Server services and uses the certicates to authenticate to
vCenter Single Sign-On through SAML token exchange. Each solution user must be authenticated to
vCenter Single Sign-On.
Solution user certicates are used for authentication tovCenter Single Sign-On. A solution user presents the
certicate to vCenter Single Sign-On when it rst has to authenticate, after a reboot, and after a timeout has
elapsed. The timeout (Holder-of-Key Timeout) can be set from the vSphere Web Client and defaults to
2592000 seconds (30 days).
For example, the vpxd solution user presents its certicate to vCenter Single Sign-On when it connects to
vCenter Single Sign-On. The vpxd solution user receives a SAML token from vCenter Single Sign-On and
can then use that token to authenticate to other solution users and services.
vSphere Security
70 VMware, Inc.