Some key server (KMS) vendors require that you upload the trusted key provider's client certificate to the key server. After the upload, the key server accepts traffic that comes from the trusted key provider.



  1. Ensure that you are connected to the vCenter Server of the Trust Authority Cluster. For example, you can enter $global:defaultviservers to show all the connected servers.
  2. (Optional) If necessary, you can run the following commands to ensure that you are connected to the vCenter Server of the Trust Authority Cluster.
    Disconnect-VIServer -server * -Confirm:$false
    Connect-VIServer -server TrustAuthorityCluster_VC_ip_address -User trust_admin_user -Password 'password'
  3. Assign the Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA information to a variable.
    For example:
    $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA

    If you are following these tasks in order, you previously assigned Get-TrustAuthorityCluster information to a variable (for example, $vTA = Get-TrustAuthorityCluster 'vTA Cluster').

    This variable obtains the trusted key providers in the given Trust Authority Cluster, in this case, $vTA.
    Note: If you have more than one trusted key provider, use commands similar to the following to select the one you want:
    Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA
    <The trusted key providers listing is displayed.>
    $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA | Select-Object -Last 1

    Using Select-Object -Last 1 selects the last trusted key provider in the list.

  4. To create the trusted key provider client certificate, run the New-TrustAuthorityKeyProviderClientCertificate cmdlet.
    For example:
    New-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp
    The thumbprint is displayed.
  5. To export the key provider client certificate, run the Export-TrustAuthorityKeyProviderClientCertificate cmdlet.
    For example:
    Export-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp -FilePath clientcert.pem
    The certificate is exported to a file.
  6. Upload the certificate file to the key server.
    See your key server documentation for more information.


The trusted key provider has established trust with the key server.