User`s guide

Verify the VMware Application Services Account
Verify that the VMware Application Services Account is a domain user. This account has full administrative
authority for the CSI_Domain database.
IMPORTANT Never use this account as a VCM login or for any other purpose.
Determine the VCM Remote Virtual Directory
You specify the VCM Remote Virtual Directory during VCM installation. You can change the account later
using the IIS Management console.
IMPORTANT When you specify the VCM Remote Virtual Directory, to minimize security risks to your
accounts, always use an account that differs from the account used for your Default Network Authority
Account or your Services Account.
Use Secure Communications Certificates
VCM uses Transport Layer Security (TLS) to secure all HTTP communication with all Windows Agents and
UNIX Agents in HTTP mode. TLS uses certificates to authenticate the Collector and Agents to each other.
During VCM installation, you must specify the Collector and Enterprise certificates. If you use your own
certificates, you must familiarize yourself with the certificate names in advance so that you can select them
during installation.
A valid Collector certificate must be:
n
Located in the local machine personal certificate store.
n
Valid for Server Authentication. If any Enhanced Key Usage extension or property is present, it must
include the Server Authentication OID 1.3.6.1.5.5.7.3.1. If the Key Usage extension is present, it
must include DIGITAL_SIGNATURE.
n
Active, and not expired.
If you do not want to use your own certificates, you can have Installation Manager generate the Collector
and Enterprise certificates for you, select the Generate option during the installation.
If you install more than one Collector that will communicate with the same Agent(s), or if you plan to
replace or renew your certificates later, you must follow the special considerations to generate and select
certificates in VCM Installation Manager. See the Transport Layer Security Implementation for VCM white
paper on the Download VMware vCenter Configuration Manager Web site.
Understand Server Authentication
VCM supports Server Authentication, which is a method to authenticate the server to the client. In VCM
environments where TLS is used, VCM Agents verify the identity of the Collectors by using and verifying
certificates over HTTP.
The server typically authenticates a client or user by requiring information such as a user name and
password. When Server Authentication is used, the client or user verifies that the server is valid. To
accomplish this verification, the server provides a certificate issued by a trusted authority, such as Verisign.
If your client Web browser has the Verisign Certified Authority certificate in its trusted store, the Web
browser can trust that the server is actually the Web site you access.
vCenter Configuration Manager Installation and Getting Started Guide
14 VMware, Inc.