After you receive the custom certificates, you can replace each machine certificate.

You must have the following information before you can start replacing the certificates:
  • Password for administrator@vsphere.local
  • Valid Machine SSL custom certificate (.crt file)
  • Valid Machine SSL custom key (.key file)
  • Valid custom certificate for Root (.crt file)


You must have received a certificate for each machine from your third-party or enterprise CA.

  • Key size: 2048 bits (minimum) to 16384 bits (maximum) (PEM encoded)
  • CRT format
  • x509 version 3
  • SubjectAltName must contain DNS Name=<machine_FQDN>.
  • Contains the following Key Usages: Digital Signature, Key Encipherment


  1. Stop all services and start the services that handle certificate creation, propagation, and storage.
    service-control --stop --all
    service-control --start vmafdd
    service-control --start vmdird
    service-control --start vmcad
  2. Log in to each node and add the new machine certificates that you received from the CA to VECS.
    All machines need the new certificate in the local certificate store to communicate over SSL.
    vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CERT
    vecs-cli entry create --store MACHINE_SSL_CERT --alias __MACHINE_CERT --cert <cert-file-path>
    --key <key-file-path>
  3. Update the lookup service registration endpoint.
    /usr/lib/vmware-lookupsvc/tools/ --url https://<vCenterServer_FQDN>/lookupservice/sdk --certfile <cert-file-path> --user 'administrator@vsphere.local' --password '<password>' --fingerprint <SHA1_hash_of_the_old_certificate_to_replace>
  4. Restart all services.
    service-control --start --all