6.5.1

n
Stop services right before you perform these tasks:
n
Delete a machine SSL certificate or any solution user certificate in VECS.
n
Replace a solution user certificate in vmdir (VMware Directory Service).
Replace Existing VMCA-Signed Certificates With New VMCA-
Signed Certificates
If the VMCA root certificate expires in the near future, or if you want to replace it for other reasons, you
can generate a new root certificate and add it to the VMware Directory Service. You can then generate
new machine SSL certificates and solution user certificates using the new root certificate.
Use the vSphere Certificate Manager utility to replace certificates for most cases.
If you need fine-grained control, this scenario gives detailed step-by-step instructions for replacing the
complete set of certificates using CLI commands. You can instead replace only individual certificates
using the procedure in the corresponding task.
Prerequisites
Only [e-mail] or other users in the CAAdmins group can perform certificate
management tasks. See Add Members to a vCenter Single Sign-On Group.
Procedure
1 Generate a New VMCA-Signed Root Certificate
You generate new VMCA-signed certificates with the certool CLI or the vSphere Certificate
Manager utility and publish the certificates to vmdir.
2 Replace Machine SSL Certificates with VMCA-Signed Certificates
After you generate a new VMCA-signed root certificate, you can replace all machine SSL certificates
in your environment.
3 Replace Solution User Certificates With New VMCA-Signed Certificates
After you replace the machine SSL certificates, you can replace all solution user certificates.
Solution user certificates must be valid, that is, not expired, but none of the other information in the
certificate is used by the certificate infrastructure.
4 Replace the VMware Directory Service Certificate in Mixed Mode Environments
During upgrade, your environment might temporarily include both vCenter Single Sign-On version
5.5 and vCenter Single Sign-On version 6.x. For that case, you have to perform additional steps to
replace the VMware Directory Service SSL certificate if you replace the SSL certificate of the node
on which the vCenter Single Sign-On service is running.
Generate a New VMCA-Signed Root Certificate
You generate new VMCA-signed certificates with the certool CLI or the vSphere Certificate Manager
utility and publish the certificates to vmdir.
In a multi-node deployment, you run root certificate generation commands on the
Platform Services Controller.
Platform Services Controller Administration
VMware, Inc. 121