About root CA certificates of vCenter server
To interact with the external entities and to establish secure communication, you need to download the vCenter server root CA certificates. Follow the steps mentioned below:
To download the root CA certificates for vCenter server:
- From a web browser, go to the base URL of the vCenter server or the vCenter server virtual appliance without appending port numbers or 'vsphere-client' extension.
For example: <https://vcenter.domain.com>
Note:
The direct URL to download the certificate: <https://vCenter FQDN/certs/download.zip> For example: <https://vcenter.domain.com/certs/download.zip>
From Linux machines: wget command can be used to download the certificates:For example:wget <https://vcenter.domain.com/certs/download.zip>
Screen shots of both methods available in related information section of this KB article.
- Click the Download trusted root CA certificates link at the bottom of the grey box on the right and download the file.
- Change the extension of the file to .zip.
- Extract the contents of the zip file. The file is a zip file of all root certificates and all the Certificate Revocation List (CRLs) in the VMware Endpoint Certificate Store (VECS).
The result is .certs folder that contains two types of files:
Files with a number as the extension (.0, .1, and so on) are root certificates.
Files with an extension that starts with an r (.r0,. r1, and so on) are CRL files associated with a certificate.
- Change the root certificates extension to .crt extension.
After the certificate is downloaded successfully, navigate to Settings >> Product Settings >> Certificate Management to install the certificate for vCenter server. Refer topic See Add root and intermediate CA certificate.