Use the Certificate Option to Establish a Trusted Connection

Some KMS vendors such as Vormetric require that you upload the vCenter Server certificate to the KMS. After the upload, the KMS accepts traffic that comes from a system with that certificate.

vCenter Server generates a certificate to protect connections with the KMS. The certificate is stored in a separate key store in the VMware Endpoint Certificate Store (VECS) on the vCenter Server system.

Procedure

1. Navigate to the vCenter Server.
2. Click Configure and select Key Management Servers.
3. Select the KMS instance with which you want to establish a trusted connection.
4. Select Certificate and click OK.
   The Download Certificate dialog box is populated with the root certificate that vCenter Server uses for encryption. This certificate is stored in VECS.

   Note: Do not generate a new certificate unless you want to replace existing certificates.
5. Copy the certificate to the clipboard or download it as a file.
6. Follow the instructions from your KMS vendor to upload the certificate to the KMS.

What to do next

Finalize the trust relationship. See Complete the Trust Setup.