6.0

VMware, Inc. 27
vSphere Server Certificates
After you obtain the certificate from each target server, follow the other setup steps appropriate for your
programing language. For C# developers, see “Setting Up for C# Development” on page 17. For Java
developers, see “Set Up for Java Development” on page 11.
For the latest information about certificates, see the vSphere Security guide at
http://www.vmware.com/support/pubs/.
Updating the Active Directory Group Policy to Accept Certificates
If you have a configuration where the VMware Certificate Authority is an intermediate Certificate Authority,
a Custom Certificate, or another certificate that is not trusted in your environment, and:
 you have a Web browser that uses the operating certificate store on Windows (such as Internet
Explorer and Google Chrome)
 you can access the vCenter Server from several different machines
you can import the root certificate into the group policy of your Active Directory environment to make the
certificates trusted in your Active Directory domain.
To import the root certificate
1 Go to the URL of the vCenter Server system or the vCenter Server Virtual Appliance using a client system
web browser.
2Click the Download trusted root CA certificates link at the bottom of the grey box on the right and
download the file.
3 Change the extension of the file to .zip.
4 The file is a ZIP file of all root certificates and all CRLs in the VMware Endpoint Certificate Store (VECS)
5Extract the ZIP file.
6The result is a .certs folder that contains two types of files. Files with a number extension (.0, .1, and
so on) are root certificates. Files with a extension that starts with an r (.r0,. r1, and so on) are CRL files
associated with a certificate.
7Open the Active Directory Group Policy Management Editor.
8Open Public Key Policies and select Intermediate Certification Authorities.
9 Add the certificate file or files that you downloaded.
10 From your Windows command prompt, run gpupdate /force to force an update.
Firefox has its own trusted roots store and does not use the operating system store. If you are working with
Firefox, download the certificate as described above, and then select Tools > Options, click Advanced, and click
Certificates to import the certificate into Firefox.
Modifying Server Configurations to Support HTTP
ESX, ESXi, and vCenter Server support the vSphere API through their respective Web services (SOAP)
engines. By default, these Web services run on port 443, as secure Web services that can be accessed using SSL
over HTTP (HTTPS). However, for a development environment, you might want to simplify the connection
process from a client application by configuring the target servers to support HTTP.
Connections to the Web services port are handled by a reverse-proxy service. The reverse-proxy service
handles requests to the API (through the /sdk path) and to the Managed Object Browser (through the /mob
path). The reverse-proxy service has a configuration file that can be modified to specify support for HTTP as
an accepted protocol for the Web service.
The procedure to modify the reverse proxy configuration differs, depending on the server type and the release
version. Choose one of the following options that applies to your situation:
 “HTTP Configuration for ESXi 5.1, 5.5, or 6.0” on page 28