You can use vSphere Certificate Manager to generate Certificate Signing Requests (CSRs). Submit those CSRs to your enterprise CA or to an external certificate authority for signing. You can use the signed certificates with the different supported certificate replacement processes.

You can use vSphere Certificate Manager to create the CSR.

If you prefer to create the CSR manually, the certificate that you send to be signed must meet the following requirements.

Key size: 2048 bits or more

PEM format. VMware supports PKCS8 and PKCS1 (RSA keys). When keys are added to VECS, they are converted to PKCS8

x509 version 3

If you are using custom certificates, the CA extension must be set to true for root certificates, and cert sign must be in the list of requirements.

CRL signing must be enabled.

Make sure that all nodes in your environment are time synchronized.

No explicit limit to the length of the certificate chain. VMCA uses the OpenSSL default, which is ten certificates.

VMCA does not support certificates with wildcards or with more than one DNS name.

You cannot create subsidiary CAs of VMCA.

vSphere Certificate Manager prompts you for information. The prompts depend on your environment and on the type of certificate that you want to replace.

For any CSR generation, you are prompted for the password of the administrator@vsphere.local user, or for the administrator of the vCenter Single Sign-On domain that you are connecting to.


Start vSphere Certificate Manager and select Option 2.

Initially, you use this option to generate the CSR, not to replace certificates.


Supply the password and the Platform Services Controller IP address or host name if prompted.


Select Option 1 to generate the CSR and answer the prompts.

As part of the process, you have to provide a directory. Certificate Manager places the certificate to be signed (*.csr file) and the corresponding key file (*.key file) in the directory.


Send the certificate to the CA for signing to the enterprise or external CA and name the file root_signing_cert.cer.


In a text editor, combine the certificates as follows.

Signed VMCA root certificate
CA intermediate certificates
Root certificate of enterprise or external CA

Save the file as root_signing_chain.cer.

Replace the existing root certificate with the chained root certificate. See Replace VMCA Root Certificate with Custom Signing Certificate and Replace All Certificates.