As we mentioned at the start of this chapter, ESXi nodes also use SSL certificates to secure communication between them and external clients. ESXi will have an autogenerated Machine SSL certificate assigned to it during the first boot post-installation. However, when an ESXi is added to vCenter Server, it is assigned a new self-signed certificate by the VMCA. VMCA issued certificates can be renewed via the web client GUI.
You can also assign custom certificates to an ESXi host, but this is a tedious certificate replacement process as it has to be manually performed on each host.
The ESXi certificates are not stored in VECS; they are stored locally on each ESXi host in the /etc/vmware/ssl directory.
In this recipe, we will learn how to renew VMCA issued ESXi certificates.
