6.7

Table Of Contents
vSphere Security Certificates 3
vSphere provides security by using certificates to encrypt communications, authenticate services, and
sign tokens.
vSphere uses certificates to:
n
Encrypt communications between two nodes, such as vCenter Server and an ESXi host.
n
Authenticate vSphere services.
n
Perform internal actions such as signing tokens.
vSphere's internal certificate authority, VMware Certificate Authority (VMCA), provides all the certificates
necessary for vCenter Server and ESXi. VMCA is installed on every Platform Services Controller,
immediately securing the solution without any other modification. Keeping this default configuration
provides the lowest operational overhead for certificate management. vSphere provides a mechanism to
renew these certificates in the event they expire.
vSphere also provides a mechanism to replace certain certificates with your own certificates. However,
replace only the SSL certificate that provides encryption between nodes, to keep your certificate
management overhead low.
The following options are recommended for managing certificates.
Table 31. Recommended Options for Managing Certificates
Mode Description Advantages
VMCA Default Certificates VMCA provides all the certificates
for vCenter Server and ESXi
hosts.
Simplest and lowest overhead. VMCA can manage the
certificate lifecycle for vCenter Server and ESXi hosts.
VMCA Default Certificates with
External SSL Certificates (Hybrid
Mode)
You replace the
Platform Services Controller and
vCenter Server Appliance SSL
certificates, and allow VMCA to
manage certificates for solution
users and ESXi hosts. Optionally,
for high-security conscious
deployments, you can replace the
ESXi host SSL certificates as well.
Simple and secure. VMCA manages internal
certificates but you get the benefit of using your
corporate-approved SSL certificates, and having those
certificates trusted by your browsers.
VMware, Inc. 72