Unless the Add Server dialog box prompted you to trust the KMS, you must explicitly establish trust after certificate exchange is complete.

You can complete the trust setup, that is, make vCenter Server trust the KMS, either by trusting the KMS or by uploading a KMS certificate. You have two options:

  • Trust the certificate explicitly by using the Refresh KMS certificate option.
  • Upload a KMS leaf certificate or the KMS CA certificate to vCenter Server by using the Upload KMS certificate option.
Note: If you upload the root CA certificate or the intermediate CA certificate, vCenter Server trusts all certificates that are signed by that CA. For strong security, upload a leaf certificate or an intermediate CA certificate that the KMS vendor controls.

Procedure

  1. Navigate to the vCenter Server.
  2. Click Configure and select Key Management Servers.
  3. Select the KMS instance with which you want to establish a trusted connection.
  4. To establish the trust relationship, refresh or upload the KMS certificate.
    Option Action
    Refresh KMS certificate
    1. Click All Actions, and select Refresh KMS certificate.
    2. In the dialog box that appears, click Trust.
    Upload KMS certificate
    1. Click All Actions, and select Upload KMS Certificate.
    2. In the dialog box that appears, click Upload file, upload a certificate file, and click OK.