You can use the SDDC Manager UI to manage certificates in a VMware Cloud Foundation instance, including integrating a certificate authority, generating and submitting certificate signing requests (CSR) to a certificate authority, and downloading and installing certificates.

Starting with VMware Cloud Foundation 5.2.1, you can also manage certificates using the vSphere Client.

This section provides instructions for the SDDC Manager UI to:

  • Use OpenSSL as a certificate authority, which is a native option in SDDC Manager.
  • Integrate with Microsoft Active Directory Certificate Services.
  • Provide signed certificates from another external Certificate Authority.

You can manage the certificates for the following components.

  • vCenter Server
  • NSX Manager
  • VMware Avi Load Balancer (formerly known as NSX Advanced Load Balancer)
  • SDDC Manager
  • VMware Aria Suite Lifecycle
    Note: Use VMware Aria Suite Lifecycle to manage certificates for the other VMware Aria Suite components.
Note: VMware Cloud Foundation does not manage certificates for ESXi hosts. By default, ESXi hosts use VMCA-signed certificates, but they can also use external CA-signed certificates. If ESXi hosts are using VMCA-signed certificates, VMCA manages the certificates and certificate rotation. If ESXi hosts are using external certificates, you are responsible for managing the certificates. For more information about external certificates, see Configure ESXi Hosts with Signed Certificates.

You replace certificates for the following reasons:

  • A certificate has expired or is nearing its expiration date.
  • A certificate has been revoked by the issuing certificate authority.
  • You do not want to use the default VMCA-signed certificates.
  • Optionally, when you create a new workload domain.

It is recommended that you replace all certificates after completing the deployment of the VMware Cloud Foundation management domain. After you create a new VI workload domain, you can replace certificates for the appropriate components as needed.