VMware Cloud Foundation 5.1

5.2 5.1 5.0 4.5
Français Italiano 日本語 English

Configure ESXi Hosts with Signed Certificates

If corporate policy requires that you use external CA-signed certificates instead of VMCA-signed certificates for ESXi hosts, you can manually add external certificates to the hosts.
External CA-signed certificate and key are available.
When you install ESXi software on a server to create an ESXi host, the host initially has an autogenerated certificate. By default, when the host is added to a vCenter Server system during bring-up of the management domain or other operations involving hosts (for example, host commissioning, VI workload domain creation, and so on), the autogenerated certificate is replaced with a certificate that is signed by the VMware Certificate Authority (VMCA).
When you use external certificates during bring-up, they are not replaced by VMCA-signed certificates. Once you perform bring-up with external certificates for ESXi hosts, all future hosts added to VMware Cloud Foundation must also use external certificates.
  1. In a web browser, log in to the ESXi host using the VMware Host Client.
  2. In the navigation pane, click
    Manage
     and click the
    Services
     tab.
    The Services tab for an ESXi host in the VMware Host Client.
  3. Select the
    TSM-SSH
     service and click
    Start
     if not started.
  4. Log in to the ESXi Shell for the first host, either directly from the DCUI or from an SSH client, as a user with administrator privileges.
  5. In the directory
    /etc/vmware/ssl
    , rename the existing certificates using the following commands:
    mv rui.crt orig.rui.crt 
    mv rui.key orig.rui.key
  6. Copy the external certificate and key that you want to use to
    /etc/vmware/ssl
    .
  7. Rename the external certificate and key to
    rui.crt
     and
    rui.key
    .
  8. Restart the host management agents by running the following commands:
    /etc/init.d/hostd restart
    /etc/init.d/vpxa restart
  9. In the VMware Host Client, select the
    TSM-SSH
     service for the ESXi host and click
    Stop
    .
  10. Repeat for all the ESXi hosts that you are adding to VMware Cloud Foundation.

Content feedback and comments