6.5.1

4 Replace Solution User Certificates with VMCA Certificates (Intermediate CA)
In a multi-node environment that uses VMCA as an intermediate CA, you can replace the solution
user certificates explicitly. First you replace the VMCA root certificate on the
Platform Services Controller node, and then you can replace the certificates on the vCenter Server
nodes to have the certificates signed by the full chain. You can also use this option to replace
solution user certificates that are corrupt or about to expire.
Generate CSR with vSphere Certificate Manager and Prepare Root Certificate
(Intermediate CA)
You can use vSphere Certificate Manager to generate Certificate Signing Requests (CSRs). Submit those
CSRs to your enterprise CA or to an external certificate authority for signing. You can use the signed
certificates with the different supported certificate replacement processes.
n
You can use vSphere Certificate Manager to create the CSR.
n
If you prefer to create the CSR manually, the certificate that you send to be signed must meet the
following requirements.
n
Key size: 2048 bits or more
n
PEM format. VMware supports PKCS8 and PKCS1 (RSA keys). When keys are added to VECS,
they are converted to PKCS8
n
x509 version 3
n
If you are using custom certificates, the CA extension must be set to true for root certificates, and
cert sign must be in the list of requirements.
n
CRL signing must be enabled.
n
Enhanced Key Usage must not contain Client Authentication or Server Authentication.
n
No explicit limit to the length of the certificate chain. VMCA uses the OpenSSL default, which is
10 certificates.
n
Certificates with wildcards or with more than one DNS name are not supported.
n
You cannot create subsidiary CAs of VMCA.
See VMware Knowledge Base Article 2112009, Creating a Microsoft Certificate Authority
Template for SSL certificate creation in vSphere 6.0, for an example using Microsoft Certificate
Authority.
Prerequisites
vSphere Certificate Manager prompts you for information. The prompts depend on your environment and
on the type of certificate that you want to replace.
For any CSR generation, you are prompted for the password of the [e-mail] user, or
for the administrator of the vCenter Single Sign-On domain that you are connecting to.
Platform Services Controller Administration
VMware, Inc. 111