Use the vSphere Automation API to manage trusted root certificate chains, VMware Certificate Authority (VMCA) root certificates, machine SSL (TLS) certificates, and Security Token Service (STS) signing certificates.

With the vSphere Automation API, you can refresh the VMCA-issued certificates but also add external and third-party certificates to your vSphere environment. For more information on vSphere certificate management, see the vSphere Authentication guide.

Certificate Management Interfaces

You can use the following interfaces to manage certificates with the vSphere Automation API:

  • Trusted Root Chains

  • VMCA Root

  • TLS CSR

  • TLS

  • Signing Certificate

Certificate Management Operations

You can use the operations listed in the following table to manage certificates.

Table 1. Certificate Management Operations

Operation

Interface

HTTP Request

Description

Introduced in

List trusted root certificates

Trusted Root Chains

GET https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/trusted-root-chains

You can retrieve the identifiers of all trusted root certificates that are present in vCenter Server.

vSphere 6.7 U2

Get trusted root certificate information

Trusted Root Chains

GET https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/trusted-root-chains/<chain>

You can retrieve a root certificate chain by providing its identifier. You can retrieve the identifier by using the List trusted root certificates operation.

vSphere 6.7 U2

Add a trusted root certificate

Trusted Root Chains

POST https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/trusted-root-chains

Use this operation to add a trusted root certificate chain to your vCenter Server system.

vSphere 6.7 U2

Delete a trusted root certificate

Trusted Root Chains

DELETE https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/trusted-root-chains/<chain>

You can delete a root certificate by providing its unique identifier. You can retrieve the identifier by using the List trusted root certificates operation.

vSphere 6.7 U2

Replace the VMCA root certificate

VMCA Root

POST https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/vmca-root

You can replace the VMCA root certificate with a new VMCA-signed certificate. The operation triggers a restart of the services that are using this certificate.

vSphere 7.0

Generate a CSR

TLS CSR

POST https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/tls-csr

You can generate a CSR and use it to issue a custom certificate. If the operation is successful, you receive a CSR in PEM format.

vSphere 6.7 U2

Get the Machine SSL certificate

TLS

GET https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/tls

You can retrieve the Machine SSL certificate of your vCenter Server system.

vSphere 6.7 U2

Renew the Machine SSL certificate

TLS

POST https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/tls?action=renew

You can renew the validity of the machine SSL certificate for a specified period in days. The duration must be less than or equal to 730 days.

vSphere 6.7 U2

Replace the Machine SSL certificate with a custom signed certificate

TLS

PUT https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/tls

You can replace the vCenter Server Machine SSL certificate with a custom certificate signed by an external Certificate Authority (CA).

vSphere 6.7 U2

Replace the Machine SSL certificate with a VMCA-signed certificate

TLS

POST https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/tls?action=replace-vmca-signed

You can replace the vCenter Server Machine SSL certificate with a VMCA-signed certificate.

vSphere 7.0

Retrieve the STS signing certificate chains

Signing Certificate

GET https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/signing-certificate

You can retrieve the STS signing certificate chains, which are used for validating tokens signed by vCenter Server.

vSphere 7.0 U3

Replace the STS signing certificate

Signing Certificate

PUT https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/signing-certificate

You can replace the current STS signing certificate with a certificate of your choice. The accepted file format is PEM.

vSphere 7.0 U3

Refresh the STS signing certificate

Signing Certificate

POST https://<vcenter_ip_address_or_fqdn>/api/vcenter/certificate-management/vcenter/signing-certificate?action=refresh

You can replace the current STS signing certificate with a new VMCA-signed certificate. The newly-generated certificate is set as the active STS signing certificate for the vCenter Server token service.

vSphere 7.0 U3