Skip to content
Docs sslbrain sslbrain.com

VMware vCenter

Copy link to the page “VMware vCenter”

← All integrations

Storage and virtualisation

Renews vCenter Machine SSL or one selected managed ESXi host through vCenter.

The appliance runs the package and connects to VMware vCenter through vSphere REST / VI JSON API over HTTPS on port 443. No agent is installed on VMware vCenter.

What happens

  1. The appliance connects to VMware vCenter through vSphere REST / VI JSON API on port 443.
  2. Without ESXI_HOST, Machine SSL is renewed. With ESXI_HOST, one host, its version and certificate mode are discovered.
  3. HOST_CERTIFICATE_METHOD=auto follows the discovered VMware mode: VMCA renewal or custom installation on the selected host. If it fails: Rollback requires a backup with the previous matching key. It checks the active certificate before and after restoration.
  4. Verification: a fresh TLS connection and vCenter inventory confirm the host certificate and connected state. Machine SSL is checked against API and TLS.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to vSphere REST / VI JSON API, port 443. No agent is installed.
Service ports
443
You need
vCenter SSO account: CertificateManagement.Administer for Machine SSL; inventory/trusted-root read access and Certificate.Manage on the selected host. Global custom choice requires Global.Settings and, on 8.0 U3, permission to restart vpxd.
Platform
Machine SSL: vCenter 7.0 U1+. Managed ESXi: VMCA on 8.0 U1+/9.0; custom requires vCenter and host 8.0 U3 or 9.0.
Actions
Discovery, Installation, Verification, Rollback
Packages
vmware-vcenter-api 1.4.0
Note
  • Choose auto, vmca or custom. New fields are optional; Machine SSL works without ESXI_HOST. Managed hosts use vCenter; standalone ESXi retains its SSH integration.
  • VCENTER_CERTIFICATE_MODE=custom is a separate customer choice: it affects ALL managed hosts and may restart vCenter services.
  • Unknown certificate writer: another process may change the certificate again. HOST_CERTIFICATE_OWNER=external directs you to the known manager workflow; registered integrations do not prove host ownership.
  • Machine SSL and custom require CERT_PEM/KEY_PEM: RSA 2048, 3072 or 4096 bits, a matching key and an RSA CA chain. VMCA does not require these fields. The custom chain must already be trusted in vCenter; the agent does not change trusted roots.
  • Management TLS is verified by default. Machine SSL may restart services. Rollback to previous matching material is exempt from the new key policy.
  • Machine SSL on vCenter 7.0 U1 and later: ECC is refused before API calls; the supplied certificate chain must also use RSA. Broadcom KB 420663 documents the RSA requirement; KB 447470 documents failures when an ECDSA Machine SSL certificate is later replaced.

Get started