When you select this option, vSphere Certificate Manager prompts you for replacement certificates for the existing solution user certificates. In multi-node deployments, run vSphere Certificate Manager with this option to replace the machine solution user certificate on the Platform Services Controller and the full set of solution users on each management node.

Before you start, you need a CSR for each machine in your environment. You can generate the CSR using vSphere Certificate Manager or explicitly.

1

To generate the CSR using vSphere Certificate Manager, see Generate Certificate Signing Requests with vSphere Certificate Manager (Custom Certificates).

2

To generate the CSR explicitly, request a certificate for each solution user on each node from your third-party or enterprise CA. The certificate must meet the following requirements:

Key size: 2048 bits or more (PEM encoded)

CRT format

x509 version 3

SubjectAltName must contain DNS Name=<machine_FQDN>

Each solution user certificate must have a different Subject. Consider, for example, including the solution user name (such as vpxd) or other unique identifier.

Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment

See also VMware Knowledge Base article 2112014, Obtaining vSphere certificates from a Microsoft Certificate Authority.

1

Start vSphere Certificate Manager and select option 5.

2

Select option 2 to start certificate replacement and respond to the prompts.

vSphere Certificate Manager prompts you for the following information:

Password for administrator@vsphere.local.

Certificate and key for machine solution user

If you run vSphere Certificate Manager on a Platform Services Controller node, you are prompted for the certificate and key (vpxd.crt and vpxd.key) for the machine solution user.

If you run vSphere Certificate Manager on a management node or an embedded deployment, you are prompted for the full set of certificates and keys (vpxd.crt and vpxd.key) for all solution users.

Depending on your environment, you might have to replace additional certificates explicitly.

If company policy requires that you replace all certificates, replace the vmdir root certificate. See Replace the VMware Directory Service Certificate

If you are upgrading from a vSphere 5.x environment, you might have to replace the vCenter Single Sign-On certificate inside vmdir. See Replace the VMware Directory Service Certificate in Mixed Mode Environments