2V0-21.23 Question 235
Single answerA vSphere administrator is tasked with securing the vCenter Server environment by replacing its default self-signed certificates with custom certificates signed by an external Certificate Authority (CA). After generating the CSR (Certificate Signing Request) and obtaining the signed certificates, the administrator needs to configure the new certificates in vSphere. Which method should the administrator use to replace the certificates?
- A
Use the vSphere Client to upload and replace the certificates through the Certificate Management interface.
- B
Directly replace the certificate files in the vCenter Server file system and restart the services.
- C
Use the VMware Certificate Authority (VMCA) as an intermediate CA and replace the certificates through the vSphere Certificate Manager utility.
- D
Reinstall the vCenter Server and specify the new certificates during the installation process.
Show answer and explanation
Correct answer: C
Explanation
The VMware-recommended method for replacing vCenter Server certificates signed by an external Certificate Authority (CA) is to use the VMware Certificate Authority (VMCA) as an intermediate CA and replace the certificates through the vSphere Certificate Manager utility. This ensures that the process is properly managed and that all relevant services are configured correctly with the new certificates.
- A. Incorrect.
The vSphere Client does provide a Certificate Management interface, but it is not used for replacing vCenter Server certificates signed by an external CA. This option is incorrect.
- B. Incorrect.
Directly replacing certificate files in the vCenter Server file system is not a supported method for certificate replacement and can lead to system issues. This option is incorrect.
- C. Correct.
Using the VMware Certificate Authority (VMCA) as an intermediate CA and replacing the certificates through the vSphere Certificate Manager utility is the correct method. The vSphere Certificate Manager utility provides a guided process to replace certificates, ensuring consistency and proper configuration.
- D. Incorrect.
Reinstalling the vCenter Server to replace certificates is not a recommended or practical approach. Certificates can be replaced without reinstalling the entire server. This option is incorrect.