Hello AndreasEC,

Here are the steps that are recommended for changing vCenter Certificates.

Replacement Methods

Option 1: VMCA as Intermediate CA (Recommended)

1. Generate a CSR from VMCA

2. Submit CSR to your enterprise/external CA

3. Import the signed certificate

4. VMCA issues certificates subordinate to your CA

Option 2: Full Custom Certificate Replacement

1. Obtain certificates from your CA for each service

2. Replace certificates manually using the Certificate Manager

Option 3: VMCA Default (Self-Signed)

- Used primarily in lab environments

- VMCA acts as its own root CA

Using the Certificate Manager Tool

```bash

# SSH into vCenter appliance

# Launch the certificate manager

/usr/lib/vmware-vmca/bin/certificate-manager

```

Menu Options:

1. Replace Machine SSL certificate with Custom Certificate

2. Replace VMCA Root certificate with Custom Signing Certificate

3. Replace Machine SSL certificate with VMCA Certificate

4. Regenerate a new VMCA Root Certificate

5. Replace Solution User certificates with Custom Certificate

6. Replace Solution User certificates with VMCA certificates

7. Revert last performed operation

8. Reset all Certificates

General Steps

1. Pre-Replacement

✅ Take a snapshot/backup of the vCenter appliance

✅ Document current certificate details

✅ Verify CA chain and certificate requirements

✅ Check certificate format (PEM required)

✅ Ensure time synchronization (NTP)

2. Certificate Requirements

| Requirement | Value |

|---|---|

| Format | PEM (Base64 encoded) |

| Key Size | 2048-bit minimum |

| Algorithm | SHA-256 or higher |

| SAN | FQDN and short name of vCenter |

| Key Usage | Digital Signature, Key Encipherment |

| Enhanced Key Usage | Server Authentication |

3. Post-Replacement

Restart vCenter services

Verify connectivity from vSphere Client

Re-trust certificates on connected ESXi hosts

Update trust in integrated products (e.g., vSAN, NSX, SRM)

Dell-Specific Considerations

When vCenter is integrated with Dell products, certificate changes may affect:

| Product | Impact |

|---|---|

| OpenManage Integration for VMware vCenter (OMIVV) | May need to re-register |

| iDRAC | vCenter plugin trust may need updating |

| VxRail | Follow VxRail-specific certificate procedures |

| PowerStore / Unity / PowerScale | VASA provider re-registration may be needed |

| APEX Cloud Platform | Follow Dell-specific guidance |

@DELL-Sam L​  thanks for reply. One thing that is not clear in your answer is my question number 2 regarding vxrail version 9 vs 8. same process ?

Hello AndreasEC,

I have not verified that the process that you have laid out will work with the newer versions, since VmWare is not part of Dell/EMC any longer since Broadcom purchased them in November of 2023. the steps that were provided are the steps that is needed to change certificate.