VMware use standard X.509 version 3 certificates to encrypt session information sent over Secure Socket Layer protocol connections between the client and the server.
If you want to replace default certificates for vCenter Server and ESXi , the certificates you obtain for your servers must be signed and must conform to the Privacy Enhanced Mail (PEM) key format. The key used to sign certificates must be a standard RSA key with an encryption length that ranges from 512 to 4,096 bits. The recommended length is 2,048 bits.
Certificates signed by a commercial certificate authority, such as Entrust or VeriSign, are pre-trusted on the Windows operating system. However, if you replace a certificate with one signed by your own local root CA, or if you plan to continue using a default certificate, you must pre-trust the certificate by importing it into the local certificate store for each vSphere Client instance.
Certificate files located on an ESXi host are
- Private key file: /etc/vmware/ssl/rui.key
- Certification file: /etc/vmware/ssl/rui.crt
NOTE Use commercially signed certificates for systems that are exposed to the Internet.
When you replace default server certificates in a production environment, deploy the new certificates in stages, rather than all at the same time.
You will need to generate a new certificate if the ESXi host or vCenter Server certificate gets deleted, or if you change the hostname of the system. These would be the most common reasons to generate a new SSL certificate.
The steps to generate a new ESXi host certificate are detailed here:
Step 1. Log in to the ESXi shell as the root user.
Step 2. Back up any existing certificates, just in case.
# mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.old
# mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.old
NOTE: If the rui.crt and rui.key files do not exist then you do not need to back them up; you can just go to the next step.
Step 3. Generate the new certificates:
Step 4. Reboot the ESXi host or restart the hostd process: