User`s guide

To guarantee the identity of servers and clients, TLS uses certificates that are managed by a public key
infrastructure (PKI). A certificate is a package that contains a public key, information that identifies the
owner and source of that key, and one or more certifications (signatures) to verify that the package is
authentic. To sign a certificate, an issuer adds information about itself to the information that is already
contained in the certificate request. The public key and identifying information are hashed and signed
using the private key of the issuer’s certificate.
Certificates are defined by the X.509 RFC standard, which includes fields that form a contract between the
creator and consumer. The Enhanced Key Usage extension specifies the use for which the certificate is
valid, including Server Authentication.
Enterprise and Collector Certificates
An Enterprise Certificate and one or more Collector Certificates enable secure HTTP Collector and Agent
communication in VCM. The Enterprise Certificate enables VCM to operate in a multi-Collector
environment. Agents have the Enterprise Certificate in their trusted certificate stores, and they use the
Enterprise Certificate to validate any certificate issued by the Enterprise Certificate. All Collector
Certificates are expected to be issued by the Enterprise Certificate, which is critical in environments where
a single Agent is shared between two Collectors.
Server authentication is required to establish a TLS connection with an Agent. All VCM Collectors should
have a common Enterprise Certificate. Each Collector Certificate is issued by the Enterprise Certificate,
and is capable of Server Authentication. Collector Certificates in VCM must adhere to the requirements
for secure communications certificates. See "General Prerequisites to Install VCM" on page 12.
n
The Collector Certificate initiates and secures a TLS communication channel with an HTTP Agent. The
Agent must be able to establish that the Collector Certificate can be trusted, which means that the
Collector Certificate is valid and the certification path starting with the Collector Certificate ends with a
trusted certificate. By design, the Enterprise Certificate is installed in the Agent’s trusted store. The trust
chain ends with the Enterprise Certificate.
n
A Collector Certificate can issue Agent certificates. When all Collector Certificates are issued by the
same Enterprise Certificate, any Agent Certificate may be issued by any Collector Certificate, and all
Agents can trust all Collectors. All Collectors can validate all Agent Certificates. Agent Certificates are
used for Mutual Authentication only. VCM supports Mutual Authentication, which requires interaction
with VMware Technical Support and a Collector Certificate that has certificate signing capability.
n
The Collector Certificate and associated private key must be available to the Collector. This certificate is
stored in the local machine personal system store.
Delivering Initial Certificates to Agents
VCM Agents use the Enterprise Certificate to validate Collector Certificates. The Agent must have access
to the Enterprise Certificate as a trusted certificate. In most cases, VCM delivers and installs the Enterprise
Certificate as needed.
n
Installing the Agent from a Disk (Windows only)
The VCM Installation DVD does not contain customer-specific certificates. If HTTP is specified, the
manual VCM installer requests the location of the Enterprise Certificate file during the installation. You
must have the Enterprise Certificate file available at installation time. You can copy the certificate file,
which has a .pem extension, from the CollectorData folder on the Collector. You must copy the
certificate file when you run the manual installer directly using CMAgentInstall.exe or when you
use the Agent Only option in the DVD auto-run program.
n
Using CMAgentInstall.exe to Install the Agent (Windows only)
Preparing for Installation
VMware, Inc. 15