You can replace the default VMCA-signed ESXi certificates by using the vifs command.

You run vifs as a vCLI command. See vSphere Command-Line Interface Reference.

Prerequisites

  • If you want to use third-party CA-signed certificates, generate the certificate request, send it to the certificate authority, and store the certificates on each ESXi host.
  • If necessary, enable the ESXi Shell or enable SSH traffic from the vSphere Client.
  • All file transfers and other communications occur over a secure HTTPS session. The user who is used to authenticate the session must have the privilege Host.Config.AdvancedConfig on the host.

Procedure

  1. Back up the existing certificates.
  2. Generate a certificate request following the instructions from the certificate authority.
    See Requirements for ESXi Certificate Signing Requests.
  3. When you have the certificate, use the vifs command to upload the certificate to the appropriate location on the host from an SSH connection to the host.
    vifs --server hostname --username username --put rui.crt /host/ssl_cert
    vifs --server hostname --username username --put rui.key /host/ssl_key
  4. Restart the host.
    Alternatively, you can put the host into maintenance mode, install the new certificate, use the Direct Console User Interface (DCUI) to restart the management agents, and set the host to exit maintenance mode.

What to do next

Update the vCenter Server TRUSTED_ROOTS store. See Update the vCenter Server TRUSTED_ROOTS Store (Custom Certificates).