When you install ESXi, a default certificate for the host is generated. This is a ‘self-signed’ certificate and as such will not be trusted by default in it’s communications with other systems. Because of this, in many environments, it is preferred that the default certificate is replaced with a trusted certificate from a CA (certificate authority). This could be a well-known external certificate authority or a trusted internal CA.

The process for replacing the default certificate on an ESXi host, documented?here?by VMware, is as follows:

• Log into the ESXi host as a user with root privileges

• Rename the existing certificates located in /etc/vmware/ssl

mv?rui.crt?orig.rui.crt mv?rui.key?orig.rui.key

• Copy the new certificate and key to /etc/vmware/ssl

• Rename the two new files to rui.crt and rui.key using the ‘mv’ command

• Restart the host, or the hosts management agents

There are a couple of things to bear in mind with this:

• ESXi?supports only X.509 certificates to encrypt session information sent over SSL

• If the Verify Certificates option is set then the host is likely to drop out of vCenter if the new cert is not verifiable by vCenter. In this case the host will have to be reconnected to vCenter.

Useful Links and Resources

http://www.vmware.com/files/pdf/techpaper/vsp_51_vcserver_esxi_certificates.pdf

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2015499

本文轉(zhuǎn)自學(xué)海無涯博客51CTO博客，原文鏈接http://blog.51cto.com/549687/1829992如需轉(zhuǎn)載請自行聯(lián)系原作者

520feng2007

總結(jié)

以上是生活随笔為你收集整理的Replacing the ESXi Host Default Certificate with a CA-Signed Certificate的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。