In VCF 9.1, certificate rotation is a fleet level task you run from VCF Operations. Certificate management moved out of the SDDC Manager interface and now sits under Fleet Management, alongside password management and the software depot. You configure a certificate authority once per scope, generate a certificate signing request for each component, and let VCF Operations push the signed certificate and its full chain onto the appliance. This guide walks the click by click flow for a Microsoft Certificate Authority, covers the OpenSSL and external file options, and shows how to switch on automatic renewal so certificates stop expiring on you.

Rotate certificates whenever a certificate nears expiry, when you move from the built in VMCA certificates to enterprise trusted ones, or when a security policy requires a fresh key. Password and credential rotation is a separate task, covered in Part 6 of this series, so this part stays on certificates only. If you have not upgraded yet, finish the upgrade to VCF 9.1 and read the Part 1 overview of the operating model first.

Certificate rotation model in VCF 9.1

VCF Operations splits the fleet into two certificate scopes, and each scope supports a different set of certificate authorities. Pick the scope that owns the component you want to rotate, then configure a CA for that scope. The table below maps components to scopes and supported authorities.

Plan the order before you start. Rotate the VCF Management scope first, since VCF Operations itself drives every other rotation, then work through each VCF Instance. Within an instance, a practical order is SDDC Manager, then vCenter, then NSX Manager, and finally the ESX hosts, rotating one component at a time and pausing to confirm health. Do not run parallel replacements on components that trust each other, because a mid flight chain change can break an active session. If you manage more than one VCF Instance, treat each as its own rotation cycle with its own certificate authority configuration.

Prerequisites

Confirm the following items before you configure a certificate authority. A missing template or a wrong account format is the most common reason the configuration step fails.

Step 1, Review the current certificate inventory

Start in VCF Operations and read the current state, so you know which components carry VMCA certificates and which expire soon. Console for this step: VCF Operations.

1. Open a browser to https://<vcf_operations_fqdn> and sign in with a user assigned the Administrator role.
2. In the navigation pane, click Fleet Management, then click Certificates.
3. Click VCF Management to review Fleet Management, VCF Automation and VCF Operations certificates.
4. Click VCF Instances, then click a VCF instance name to review SDDC Manager, vCenter, NSX Manager and ESX host certificates.
5. Note each issuer, validity date and any certificate alert, so you can plan the rotation order.

Step 2, Prepare the certificate authority

For a Microsoft CA, create the issuing template and service account before you configure anything in VCF Operations. This work happens on your Windows Certificate Authority, not in a VCF console.

1. On the CA, duplicate a template that supports Server Authentication and Client Authentication, and name it something recognizable such as VMware.
2. Publish the template on the issuing CA under Certificate Templates, so it accepts requests.
3. Create a least privileged service account, for example svc-vcf-ca, and grant it Request Certificates on the CA.
4. Record the CA URL in the form https://ca.example.com/certsrv and confirm it responds over port 443.

For VCF Instance components you can use OpenSSL configured on the SDDC Manager appliance instead, which needs no external template. VCF Management components accept Microsoft CA only.

Step 3, Configure the certificate authority in VCF Operations

Register the CA once per scope. Repeat this step for VCF Management and for each VCF Instance you plan to rotate. Console for this step: VCF Operations.

1. In Fleet Management, click Certificates.
2. Click VCF Management, or click VCF Instances and select a VCF instance name.
3. Click Configure CA.
4. For a Microsoft CA, enter the CA Server URL as https://ca.example.com/certsrv.
5. In User Name, type the service account in UPN format, for example svc-vcf-ca@corp.example.com.
6. Type the account password in Password, then enter the issuing template in Template Name, for example VMware.
7. Click Save and wait for the success confirmation.

To use OpenSSL on a VCF Instance, choose OpenSSL and complete Common Name, Country, Locality Name, Organization Name, Organization Unit Name and State, then click Save.

Step 4, Generate a certificate signing request

Generate one CSR per component. Keep a strict one to one relationship, since VCF Operations matches the applied certificate to the exact key in the CSR. Console for this step: VCF Operations.

1. On the Certificates page, open the scope that owns the component, then select the component row.
2. Use the Show ESX Hosts toggle if you need to show or hide ESX hosts in the list.
3. Click the three dot menu, then select Generate CSR.
4. Enter Common Name, Organization, Organizational Unit, Country, State/Province and Locality for your organization.
5. Complete Host and Subject Alternative Name, and optionally an Email Address contact.
6. Select a Key Size of 2048 bit or 4096 bit; note that ESX hosts accept 2048 bit only.
7. Click Save and wait until the CSR shows as successfully generated.

Step 5, Replace the certificate with the configured CA certificate

With a CSR in place, replace the live certificate. VCF Operations signs the request against the configured CA and installs the certificate with its chain. Console for this step: VCF Operations.

1. Select the same component you generated the CSR for.
2. Click the three dot menu, then select Replace With Configured CA Certificate.
3. Select your CA from the list; OpenSSL appears for VCF Instance components only.
4. Click Confirm to start the replacement.
5. Wait about 2 to 3 minutes for the operation to finish, then confirm the row shows the new issuer.

Step 6, Turn on automatic certificate renewal

Once a component holds a CA signed certificate, switch on automatic renewal so VCF Operations reissues it before expiry, with no manual outage. Renewal applies to Microsoft CA and OpenSSL certificates. Console for this step: VCF Operations.

1. On the Certificates page, open the scope and select the component you rotated.
2. Open the three dot menu and choose the automatic renewal option for the certificate.
3. Confirm the CA to use for renewal, then save the setting.
4. Verify the component now shows automatic renewal as enabled.

Optional, Replace with an external CA signed certificate

When your signing CA is offline or run by a separate team, skip the configured CA flow and upload files instead. Generate the CSR in Step 4, hand it to your CA, then install the returned files. Console for this step: VCF Operations.

1. Complete Generate CSR in Step 4 and download the request for your external CA.
2. After your CA signs it, open the three dot menu and select the option to import a server certificate and certificate authority files.
3. Upload the Server Certificate file and the CA chain file returned by your certificate authority.
4. Click Confirm and wait for the install to finish, then check the issuer on the row.

Verify the new certificate

Confirm the rotation two ways: read the issuer in VCF Operations, then check the live certificate from a workstation. Run this command against each component you rotated, replacing the host name and port as needed.

echo | openssl s_client -connect sddc-manager.example.com:443 -servername sddc-manager.example.com 2>/dev/null | openssl x509 -noout -issuer -subject -dates

Check that the issuer line names your certificate authority, that the subject matches the component FQDN, and that the notAfter date reflects the fresh validity period. In VCF Operations, the component row on the Certificates page should show the new issuer and clear any prior expiry alert. If you enabled renewal, confirm the automatic renewal state as well.

Common errors and fixes

For a deeper look at certificate, identity and backup failures across VCF 9, read VCF 9 certificate, identity and backup failures and how to fix them. For context on where certificate management sits inside the wider platform, the VCF 9.1 deployment guide covers the initial appliance setup.

Common questions

Can I still rotate certificates from the SDDC Manager UI
No. In VCF 9.1 certificate workflows run from VCF Operations under Fleet Management, Certificates. SDDC Manager still owns domain operations such as adding hosts and clusters, but not certificate rotation.

Does a certificate replacement cause an outage
Each replacement restarts services on the target component and runs for about 2 to 3 minutes. Rotate one component at a time and confirm health before moving to the next.

Why does VCF Management not offer OpenSSL
VCF Management components accept Microsoft CA only. OpenSSL is available for VCF Instance components such as SDDC Manager, vCenter and NSX Manager.

What key size should I choose
Use 2048 bit or 4096 bit for most components. ESX hosts accept 2048 bit only, so keep host CSRs at that size.

References

• Managing Certificates in VMware Cloud Foundation, Broadcom TechDocs
• Configure a Certificate Authority for VMware Cloud Foundation, Broadcom TechDocs
• Replace a Certificate with a CA Signed Certificate, Broadcom TechDocs
• Automatic Certificate Renewal in VMware Cloud Foundation 9, VCF Blog

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts