vSphere Replication verifies the certificates of vCenter Server and remote vSphere Replication servers.
All communication between vCenter Server, the local vSphere Replication appliance, and the remote vSphere Replication appliance goes through a vCenter Server proxy at port 80. All SSL traffic is tunneled.
vSphere Replication can trust remote server certificates either by verifying the validity of the certificate and its thumbprint or by verifying the thumbprint only. The default is to verify by thumbprint only. You can activate the verification of the certificate validity. See How to Activate the Verification of Certificate Validity.
- Thumbprint Verification
-
vSphere Replication checks for a thumbprint match. vSphere Replication trusts remote server certificates if it can verify the thumbprints through secure vSphere platform channels or, in some rare cases, after the user confirms them. vSphere Replication only takes certificate thumbprints into account when verifying the certificates and does not check the certificate validity.
- Verification of Thumbprint and Certificate Validity
-
vSphere Replication checks the thumbprint and checks that all server certificates are valid. If you enabled vSphere Replication to accept only SSL certificates signed by a trusted Certificate Authority, vSphere Replication refuses to communicate with a server with an invalid certificate. When verifying certificate validity, vSphere Replication checks expiration dates, subject names, and the certificate issuing authorities.
In both modes, vSphere Replication retrieves thumbprints from vCenter Server. vSphere Replication refuses to communicate with a server if the automatically determined thumbprint differs from the actual thumbprint that it detects while communicating with the respective server.
You can mix trust modes between vSphere Replication appliances at different sites. A pair of vSphere Replication appliances can work successfully even if you configure them to use different trust modes.
