6.0.3

The following solution user certicate stores are included in VECS on each management node and each
embedded deployment:
n
machine: Used by component manager, license server, and the logging service.
N The machine solution user certicate has nothing to do with the machine SSL certicate. The
machine solution user certicate is used for the SAML token exchange; the machine SSL certicate is
used for secure SSL connections for a machine.
n
vpxd: vCenter service daemon (vpxd) store on management nodes and embedded deployments. vpxd
uses the solution user certicate that is stored in this store to authenticate to vCenter Single Sign-On.
n
vpxd-extensions: vCenter extensions store. Includes the Auto Deploy service, inventory service, and
other services that are not part of other solution users.
n
vsphere-webclient: vSphere Web Client store. Also includes some additional services such as the
performance chart service.
The machine store is also included on each Platform Services Controller node.
vCenter Single Sign-On Certificates
vCenter Single Sign-On certicates are not stored in VECS and are not managed with certicate
management tools. As a rule, changes are not necessary, but in special situations, you can replace these
certicates.
vCenter Single Sign-On
Signing Certificate
The vCenter Single Sign-On service includes an identity provider service
which issues SAML tokens that are used for authentication throughout
vSphere. A SAML token represents the user's identity, and also contains
group membership information. When vCenter Single Sign-On issues SAML
tokens, it signs each token with its signing certicate so that clients of
vCenter Single Sign-On can verify that the SAML token comes from a trusted
source.
vCenter Single Sign-On issues holder-of-key SAML tokens to solution users
and bearer tokens other users, which log in with a user name and password.
You can replace this certicate from the vSphere Web Client. See “Refresh the
STS Root Certicate,” on page 50.
VMware Directory
Service SSL Certificate
If you are using custom certicates, you might have to replace the VMware
Directory Service SSL certicate explicitly. See “Replace the VMware
Directory Service Certicate,” on page 110.
Certificate Requirements
When you want to use third-party certicates in your environment, you must make sure that they meet
requirements. Certicates that VMCA provisions already meet these requirements.
n
Key size: 2048 bits or more (PEM encoded)
n
PEM format. VMware supports PKCS8 and PKCS1 (RSA keys). When keys are added to VECS, they are
converted to PKCS8
n
x509 version 3
n
For root certicates, the CA extension must be set to true, and the cert sign must be in the list of
requirements.
n
SubjectAltName must contain DNS Name=<machine_FQDN>
n
CRT format
Chapter 3 vSphere Security Certificates
VMware, Inc. 71