Installation guide

Secure Communications Certificates

During VCM installation, specify the Collector and Enterprise certificates. VCM uses Transport Layer

Security (TLS) to secure all UNIX Agents and all Windows Agents using HTTP, and TLS uses certificates to

authenticate the Collector and Agents to each other.

If you use your own certificates, you must familiarize yourself with the certificate names in advance so

that you can select them during installation.

A valid Collector certificate must have the following attributes.

n Located in the local machine personal certificate store.

n Valid for Server Authentication. If any Enhanced Key Usage extension or property is present, it must

include the Server Authentication OID 1.3.6.1.5.5.7.3.1. If the Key Usage extension is present, it

must include DIGITAL_SIGNATURE.

n Active, and not expired.

If you do not want to use your own certificates, you can have Installation Manager generate the Collector

and Enterprise certificates for you, select the Generate option during the installation.

If you install more than one Collector that will communicate with the same Agents, or if you plan to

replace or renew your certificates, follow the special considerations to generate and select certificates in

VCM Installation Manager. See the VCM Security Guide.

Authenticating the Server to the Client

VCM supports Server Authentication to authenticate the server to the client. In VCM environments where

TLS is used, VCM Agents verify the identity of the Collectors by verifying the certificates. If you use your

own certificates, you must familiarize yourself with the certificate names in advance so that you can select

them during installation.

The server typically authenticates a client or user by requiring information such as a user name and

password. When Server Authentication is used, the client or user verifies that the server is valid. To

accomplish this verification, the server provides a certificate issued by a trusted authority, such as Verisign.

If your client Web browser has the Verisign Certified Authority certificate in its trusted store, the Web

browser can trust that the server is actually the Web site you access.

To guarantee the identity of servers and clients, TLS uses certificates that are managed by a public key

infrastructure (PKI). A certificate is a package that contains a public key, information that identifies the

owner and source of that key, and one or more certifications (signatures) to verify that the package is

authentic. To sign a certificate, an issuer adds information about itself to the information that is already

contained in the certificate request. The public key and identifying information are hashed and signed

using the private key of the issuer’s certificate.

VMware, Inc.