6.7

certool --selfca
Creates a self-signed certificate and provisions the VMCA server with a self-signed root CA. Using this
option is one of the simplest ways to provision the VMCA server. You can instead provision the VMCA
server with a third-party root certificate so that VMCA is an intermediate CA. See Use VMCA as an
Intermediate Certificate Authority.
This command generates a certificate that is predated by three days to avoid time zone conflicts.
Option Description
--selfca
Required for generating a self-signed certificate.
--predate <number_of_minutes>
Allows you to set the Valid Not Before field of the root certificate
to the specified number of minutes before the current time. This
option can be helpful to account for potential time zone issues.
The maximum is three days.
--config <config_file>
Optional name of the configuration file. Defaults to
certool.cfg.
--server <server>
Optional name of the VMCA server. By default, the command
uses localhost.
Example:
machine-70-59:/usr/lib/vmware-vmca/bin # ./certool --predate=2280 --selfca --server= 192.0.2.24 --srp-
upn=[e-mail]
certool --rootca
Imports a root certificate. Adds the specified certificate and private key to VMCA. VMCA always uses the
most recent root certificate for signing, but other root certificates remain trusted until you manually delete
them. That means you can update your infrastructure one step at a time, and finally delete certificates
that you no longer use.
Option Description
--rootca
Required for importing a root CA.
--cert <certfile>
Name of the certificate file.
--privkey <key_file>
Name of the private key file. This file must be in PEM encoded
format.
--server <server>
Optional name of the VMCA server. By default, the command
uses localhost.
Example:
certool --rootca --cert=root.cert --privkey=privatekey.pem
Platform Services Controller Administration
VMware, Inc. 151