You can use VMware PowerCLI to manage certificates for both vCenter Server and ESXi no matter if you are using Hybrid, Subordinate CA, or Full Custom Mode.

Starting from VMware PowerCLI 12.4.0, you can do various certificate management operations in your vSphere environment. The certificate management functionality is included in the VMware.PowerCLI.VCenter module.