vCenter TLS Security: Certificate Replacement, Cipher Hardening, and Tomcat Configuration
A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)
Quick Answer
Edit the registry on the vCenter Server to disable SSLv3 is one of the two correct answers because hardening TLS on vCenter Server involves two separate layers that don't automatically inherit from each other. The vSphere web services run on an embedded Tomcat instance, so its allowed protocols and cipher suites are controlled independently in the Tomcat configuration file, which is the other correct step in this pair. But when vCenter Server runs on Windows, the operating system itself also negotiates TLS through its SCHANNEL subsystem, and that negotiation is governed by registry settings, not by anything Tomcat controls. If an administrator only edits Tomcat, the OS layer beneath it can still offer SSLv3 to other services or clients, leaving the audit finding only partially remediated. The distractors fail for related but distinct reasons: the Certificate Manager utility swaps out certificates and doesn't touch protocol or cipher negotiation at all, jumping straight to TLS 1.3 only is overly aggressive and risks breaking client compatibility rather than being the documented hardening method, and there is no cipher-suite toggle buried in the vSphere Web Client's Security menu. When a question asks you to disable a weak protocol across a whole vCenter deployment, expect the correct answer to span both the application-level service configuration and, on Windows installs, the underlying OS security settings.
⚠ Common exam trap
Candidates often confuse vCenter Server's Windows-based legacy behavior with its current Linux-based architecture, leading them to incorrectly select registry editing (Option B) instead of recognizing that Tomcat configuration files are the correct method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Edit the registry on the vCenter Server to disable SSLv3.
To enforce strong ciphers and disable SSLv3 on a vCenter Server, the administrator should modify the Tomcat server.xml file to restrict allowed protocols and ciphers (Option E). Additionally, if the vCenter Server is running on Windows, editing the registry to disable SSLv3 is also required (Option B). Option A is incorrect because the Certificate Manager replaces certificates but does not configure cipher suites. Option C is wrong because disabling TLS 1.2 and enabling only TLS 1.3 may break compatibility and is not the standard method. Option D is incorrect as there is no such setting in the vSphere Web Client under Administration > Security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
Why it's wrong here
This is incorrect because the vSphere Certificate Manager utility replaces certificates but does not configure cipher suites or protocols. It does not enforce strong ciphers.
- ✓
Edit the registry on the vCenter Server to disable SSLv3.
Why this is correct
This is correct for a Windows-based vCenter Server. By editing the registry under SCHANNEL protocols, you can disable SSLv3 and enforce stronger protocols.
- ✗
Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.
Why it's wrong here
This is incorrect. Disabling TLS 1.2 and enabling only TLS 1.3 would weaken security and is not a standard hardening step. You should disable SSLv3 and weak protocols.
- ✗
Configure the TLS settings in the vSphere Web Client under Administration > Security.
Why it's wrong here
This is incorrect because the vSphere Web Client does not have a TLS configuration setting under Administration > Security.
- ✓
Modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols.
Why this is correct
This is correct. Modifying the Tomcat server.xml file on the vCenter Server (both Windows and Appliance) allows you to restrict allowed protocols and ciphers, effectively disabling SSLv3 and enforcing strong ciphers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VCP-DCV question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?
hard- A.Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.
- B.Restart the vCenter Management Agent (vma) service.
- ✓ C.Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.
- D.Run the certificate manager tool (certool) to generate a new self-signed certificate.
Why C: After the signed certificate is received from the CA, it must be imported into the appropriate VECS store (e.g., the machine SSL certificate store). Then, the certificate-manager utility (located at /usr/lib/vmware-vmca/bin/certificate-manager) must be run to update all vCenter services to use the new certificate. Option A is incorrect because generating a new CSR after replacement is unnecessary. Option B is incorrect because restarting the vCenter Management Agent only affects that single service, not all services that need the new certificate. Option D is incorrect because the certificate-manager utility is used for CA-signed certificates, not certool (which is for self-signed certificates).
Variation 2. During a security audit, it is found that the vCenter Server is using the default self-signed certificate. The administrator is tasked to replace it with a certificate from an enterprise CA. What is the first step after obtaining the CA-signed certificate?
medium- ✓ A.Convert the certificate and private key into PEM format and place them in the appropriate directory.
- B.Use the vSphere Web Client to upload the certificate.
- C.Import the private key into the Windows Certificate Store.
- D.Restart the VMware Certificate Service.
Why A: The certificate must be in a format that vCenter can use; typically, it needs to be combined with the private key. Option B is premature before preparing the certificate. Option C is incorrect because certificate import is done via certificate management tools, not vSphere Web Client. Option D is incorrect because the private key is included in the signed certificate generation process, not imported separately.
Variation 3. An organization wants to secure management traffic between vCenter Server and ESXi hosts. The security policy mandates disabling all versions of TLS below 1.2. After the administrator configures vCenter to use only TLS 1.2, several ESXi hosts (all version 6.0) lose connectivity to vCenter. The hosts remain operational but show as disconnected in the vSphere Web Client. The administrator needs to restore management while maintaining the security requirement. Which action should the administrator take?
easy- ✓ A.Upgrade the legacy ESXi hosts to version 6.5 or later.
- B.Disable certificate verification on the vCenter Server.
- C.Use SSH to connect vCenter to the ESXi hosts for management.
- D.Re-enable TLS 1.0 on the vCenter Server as a temporary workaround.
Why A: ESXi 6.0 only supports TLS 1.0; to use TLS 1.2, hosts must be upgraded to ESXi 6.5 or later. Option B is wrong because disabling certificate verification does not address the TLS version issue and weakens security. Option C is wrong because SSH is not used for vCenter-to-ESXi management communication. Option D is wrong because re-enabling TLS 1.0 would violate the security policy.
Variation 4. A vCenter Server's SSL certificate has expired, causing all ESXi hosts to display a certificate warning and some management tasks to fail. The administrator needs to restore secure communication with minimal disruption. Which action should the administrator take?
medium- A.Reboot the vCenter Server appliance to regenerate the certificate automatically.
- ✓ B.Replace the vCenter Server certificate and then reconnect each ESXi host to vCenter.
- C.Replace the SSL certificate on each ESXi host individually using the vSphere Web Client.
- D.Use vSphere Auto Deploy to push new certificates to all hosts simultaneously.
Why B: Replacing the vCenter Server certificate and then reconnecting each ESXi host restores trust and secure communication. Option A is wrong because rebooting the vCenter Server appliance does not regenerate the SSL certificate automatically; the certificate remains expired. Option C is wrong because replacing certificates on each ESXi host individually does not address the expired vCenter certificate and is inefficient. Option D is wrong because vSphere Auto Deploy is used for provisioning hosts, not for replacing vCenter certificates.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.