6.7

CIM is an open standard that defines a framework for agent-less, standards-based monitoring of
hardware resources for ESXi hosts. This framework consists of a CIM object manager, often called a CIM
broker, and a set of CIM providers.
CIM providers support management access to device drivers and underlying hardware. Hardware
vendors, including server manufacturers and hardware device vendors, can write providers that monitor
and manage their devices. VMware writes providers that monitor server hardware, ESXi storage
infrastructure, and virtualization-specific resources. These providers run inside the ESXi host and are
lightweight and focused on specific management tasks. The CIM broker takes information from all CIM
providers and presents it to the outside world using standard APIs. The most common API is WS-MAN.
Do not provide root credentials to remote applications that access the CIM interface. Instead, create a
service account for these applications. Grant read-only access to CIM information to any local account
defined on the ESXi system, and any role defined in vCenter Server.
Procedure
1 Create a service account for CIM applications.
2 Grant the service account read-only access to ESXi hosts that collect CIM information.
3 (Optional) If the application requires write access, create a role with only two privileges.
n
Host.Config.SystemManagement
n
Host.CIM.CIMInteraction
4 For each ESXi host that you are monitoring, create a permission that pairs the custom role with the
service account.
See Using Roles to Assign Privileges.
Certificate Management for ESXi Hosts
In vSphere 6.0 and later, the VMware Certificate Authority (VMCA) provisions each new ESXi host with a
signed certificate that has VMCA as the root certificate authority by default. Provisioning happens when
the host is added to vCenter Server explicitly or as part of installation or upgrade to ESXi 6.0 or later.
You can view and manage ESXi certificates from the vSphere Web Client and by using the
vim.CertificateManager API in the vSphere Web Services SDK. You cannot view or manage ESXi
certificates by using certificate management CLIs that are available for managing vCenter Server
certificates.
Certificates in vSphere 5.5 and in vSphere 6.x
When ESXi and vCenter Server communicate, they use TLS/SSL for almost all management traffic.
In vSphere 5.5 and earlier, the TLS/SSL endpoints are secured only by a combination of user name,
password, and thumbprint. Users can replace the corresponding self-signed certificates with their own
certificates. See the vSphere 5.5 Documentation Center.
In vSphere 6.0 and later, vCenter Server supports the following certificate modes for ESXi hosts.
vSphere Security
VMware, Inc. 51