How to Replace vCenter Server Self-Signed Certificate with a CA-Signed Certificate
During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?
Quick Answer
The correct step is to import the signed certificate into the appropriate VECS store and then run the certificate-manager utility to update the services. This is required because VECS acts as the centralized certificate repository for VMware components, but simply storing the CA-signed certificate there does not automatically apply it to vCenter services; the certificate-manager utility must be invoked to bind the new certificate to the relevant services like the Web Proxy and vpxd. On the VCP-DCV exam, this scenario tests your understanding of the complete certificate replacement workflow, often appearing as a trap where candidates mistakenly think restarting services or using certool is sufficient. Remember, certool is only for generating self-signed certificates, not for importing CA-signed ones. A helpful memory tip: "Import to VECS, then run cert-manager—never skip the utility step."
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.
After the signed certificate is received from the CA, it must be imported into the appropriate VECS store (e.g., the machine SSL certificate store). Then, the certificate-manager utility (located at /usr/lib/vmware-vmca/bin/certificate-manager) must be run to update all vCenter services to use the new certificate. Option A is incorrect because generating a new CSR after replacement is unnecessary. Option B is incorrect because restarting the vCenter Management Agent only affects that single service, not all services that need the new certificate. Option D is incorrect because the certificate-manager utility is used for CA-signed certificates, not certool (which is for self-signed certificates).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.
Why it's wrong here
Incorrect. Generating a new CSR after importing the signed certificate is unnecessary and would overwrite the existing CSR.
- ✗
Restart the vCenter Management Agent (vma) service.
Why it's wrong here
Incorrect. Restarting the vCenter Management Agent (vma) is not sufficient to update all services that use the certificate, such as the web server or STS.
- ✓
Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.
Why this is correct
Correct. Importing the signed certificate into the proper VECS store and then running the certificate-manager utility ensures all vCenter services are updated to use the new certificate.
- ✗
Run the certificate manager tool (certool) to generate a new self-signed certificate.
Why it's wrong here
Incorrect. certool is used for generating self-signed certificates, not for applying CA-signed certificates. The certificate-manager utility should be used instead.
Go deeper
Related to this question
About these practice questions
This VCP-DCV question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security audit, it is found that the vCenter Server is using the default self-signed certificate. The administrator is tasked to replace it with a certificate from an enterprise CA. What is the first step after obtaining the CA-signed certificate?
medium- ✓ A.Convert the certificate and private key into PEM format and place them in the appropriate directory.
- B.Use the vSphere Web Client to upload the certificate.
- C.Import the private key into the Windows Certificate Store.
- D.Restart the VMware Certificate Service.
Why A: The certificate must be in a format that vCenter can use; typically, it needs to be combined with the private key. Option B is premature before preparing the certificate. Option C is incorrect because certificate import is done via certificate management tools, not vSphere Web Client. Option D is incorrect because the private key is included in the signed certificate generation process, not imported separately.
Variation 2. A vCenter Server's SSL certificate has expired, causing all ESXi hosts to display a certificate warning and some management tasks to fail. The administrator needs to restore secure communication with minimal disruption. Which action should the administrator take?
medium- A.Reboot the vCenter Server appliance to regenerate the certificate automatically.
- ✓ B.Replace the vCenter Server certificate and then reconnect each ESXi host to vCenter.
- C.Replace the SSL certificate on each ESXi host individually using the vSphere Web Client.
- D.Use vSphere Auto Deploy to push new certificates to all hosts simultaneously.
Why B: Replacing the vCenter Server certificate and then reconnecting each ESXi host restores trust and secure communication. Option A is wrong because rebooting the vCenter Server appliance does not regenerate the SSL certificate automatically; the certificate remains expired. Option C is wrong because replacing certificates on each ESXi host individually does not address the expired vCenter certificate and is inefficient. Option D is wrong because vSphere Auto Deploy is used for provisioning hosts, not for replacing vCenter certificates.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.