6.2

Updating vRealize Automation
Certificates 9
A system administrator can replace certificates for vRealize Automation components. Typically, you
replace a certificate to switch from self-signed certificates to certificates provided by a certificate authority
or when a certificate expires.
When you replace a certificate for a vRealize Automation component, components that have a
dependency on this certificate are affected. You must register the new certificate with these components
to ensure certificate trust.
You must update all components of the same type in a distributed system. For example, if you update a
certificate for one vRealize Appliance in a distributed environment, you must update all instances of
vRealize Appliance for that installation.
Certificates for the Identity Appliance management site and vRealize Appliance management site do not
have registration requirements.
Note vRealize Automation supports both SHA1 and SHA2 certificates. The self-signed certificates
generated by the system use SHA-256 With RSA Encryption. You may need to update
vRealize Automation components to use SHA2 certificates due to browser requirements.
Update components in the following order:
1 Identity Appliance
2 vRealize Appliance
3 IaaS components
With one exception, changes to later components in this list do not affect earlier ones. For example, if you
import a new certificate to a vRealize Appliance, you must register this change with the IaaS server, but
not with the Identity Appliance. The exception is that an updated certificate for IaaS components must be
registered with vRealize Appliance.
The following table shows registration requirements when you update a certificate.
VMware, Inc.
149