이 문서에서는 vCenter 서버의 루트 인증서를 가져오는 방법을 보여줍니다.
이 페이지는 기본 기술 인프라의 수명 주기를 관리하는 IT 관리자 및 운영자를 위해 작성되었습니다. Google Cloud 콘텐츠에서 참조하는 일반적인 역할 및 예시 태스크에 대해 자세히 알아보려면 일반 GKE 기업 사용자 역할 및 태스크를 참조하세요.
Google Distributed Cloud와 같은 클라이언트가 vCenter 서버로 요청을 전송할 때 서버는 인증서 또는 인증서 번들을 제공하여 클라이언트에 해당 ID를 입증해야 합니다. 인증서 또는 번들을 확인하기 위해 VMware용 Google Distributed Cloud(소프트웨어만)는 트러스트 체인에 루트 인증서가 있어야 합니다.
관리자 워크스테이션 구성 파일을 입력할 때 vCenter.caCertPath 필드에 루트 인증서 경로를 제공합니다.
VMware 설치에는 vCenter Server에 인증서를 발급하는 인증 기관(CA)이 포함됩니다. 신뢰 체인의 루트 인증서는 VMware에서 생성된 자체 서명 인증서입니다.
기본값인 VMWare CA를 사용하지 않을 경우 다른 인증 기관을 사용하도록 VMware를 구성할 수 있습니다.
사용자의 vCenter 서버가 기본 VMware CA에서 발급한 인증서를 사용하는 경우 다음과 같이 인증서를 다운로드합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-22(UTC)"],[],[],null,["This document shows how to get the root certificate for your vCenter server.\nThis page is for IT administrators and Operators who manage the\nlifecycle of the underlying tech infrastructure. To learn more about common\nroles and example tasks that we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nWhen a client, like Google Distributed Cloud, sends a request to your\nvCenter server, the server must prove its identity to the client by presenting\na certificate or a certificate bundle. To verify the certificate or bundle,\nGoogle Distributed Cloud (software only) for VMware must have the root certificate in\nthe chain of trust.\n\nWhen you fill in an\n[admin workstation configuration file](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/admin-workstation-configuration-file),\nyou provide the path of the root certificate in the `vCenter.caCertPath` field.\n\nYour VMware installation has a certificate authority (CA) that issues a\ncertificate to your vCenter server. The root certificate in the chain of trust\nis a self-signed certificate created by VMware.\n\nIf you do not want to use the VMWare CA, which is the default, you can configure\nVMware to\n[use a different certificate authority](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-3D0DE463-D0EC-442E-B524-64759D063E25.html).\n\nIf your vCenter server uses a certificate issued by the default VMware CA,\ndownload the certificate as follows:\n\n```\ncurl -k \"https://[SERVER_ADDRESS]/certs/download.zip\" \u003e download.zip\n```\n\nReplace \u003cvar translate=\"no\"\u003e[SERVER_ADDRESS]\u003c/var\u003e with the address of your vCenter server.\n\nInstall the `unzip` command and unzip the certificate file:\n\n```\nsudo apt-get install unzip\nunzip download.zip\n```\n\nIf the unzip command doesn't work the first time, enter the command again.\n\nFind the certificate file and a revocation file in `certs/lin`. For example:\n\n```\n457a65e8.0\n457a65e8.r0\n```\n\nIn the preceding example, `457a65e8.0` is the certificate file, and\n`457a65e8.r0` is the revocation file.\n\nYou can rename the certificate file to any name of your choice. The file\nextension can be `.pem`, but it doesn't have to be `.pem`.\n\nFor example, suppose you rename the certificate file to `vcenter-ca-cert.pem`.\n\nView the contents of `vcenter-ca-cert.pem`:\n\n```\ncat vcenter-ca-cert.pem\n```\n\nThe output shows the base64-encoded certificate. For example:\n\n```\n-----BEGIN CERTIFICATE-----\nMIIEGTCCAwGgAwIBAgIJAPW1akYrS5L6MA0GCSqGSIb3DQEBCwUAMIGXMQswCQYD\nVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZ\nFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExGTAXBgNV\n...\n0AaWpaT9QCTS31tbBgBYB1W+IS4qeMK5dz5Tko5460GgbSNLuz5Ml+spW745RbGA\n76ePS+sXL0WYqZa1iyAb3x8E3xn5cVGtJlxXu4PkJa76OtdDjqWAlqkNvVZB\n-----END CERTIFICATE-----\n```\n\nView the decoded certificate:\n\n```\nopenssl x509 -in vcenter-ca-cert.pem -text -noout\n```\n\nThe output shows the decoded certificate For example:\n\n```\nCertificate:\n Data:\n Version: 3 (0x2)\n Serial Number:\n f5:b5:6a:46:2b:4b:92:fa\n Signature Algorithm: sha256WithRSAEncryption\n Issuer: CN = CA, DC = vsphere, DC = local, C = US, ST = California, O = uphc-vc01.anthos, OU = VMware Engineering\n Validity\n ...\n Subject: CN = CA, DC = vsphere, DC = local, C = US, ST = California, O = uphc-vc01.anthos, OU = VMware Engineering\n Subject Public Key Info:\n Public Key Algorithm: rsaEncryption\n RSA Public-Key: (2048 bit)\n Modulus:\n 00:e0:39:28:9d:c1:f5:ac:69:04:3f:b0:a0:31:9e:\n 89:0b:6e:f7:1e:2b:3b:94:ac:1c:47:f0:52:2e:fa:\n 6d:52:2c:de:66:3e:4e:40:6a:58:c7:cc:99:46:81:\n ...\n 5c:d6:a9:ab:a9:87:26:0f:d2:ef:9e:a1:61:3d:38:\n 18:bf\n Exponent: 65537 (0x10001)\n X509v3 extensions:\n ...\n Signature Algorithm: sha256WithRSAEncryption\n 58:24:57:36:a4:66:fa:16:e1:82:b1:ee:a7:1a:77:db:77:6c:\n 0a:b7:2e:7a:11:ca:0b:38:21:d2:d2:ab:3c:30:82:3f:ae:22:\n ...\n ad:26:5c:57:bb:83:e4:25:ae:fa:3a:d7:43:8e:a5:80:96:a9:\n 0d:bd:56:41\n```\n\nCopy your certificate file to a location of your choice.\n\nThen when you need to provide a value for `caCertPath` in a configuration file,\nenter the path of your certificate file.\n\nFor example, in your admin workstation configuration file:\n\n```\ngcp:\n ...\nvCenter:\n ...\n caCertPath: \"/path/to/vcenter-ca-cert.pem\"\n```"]]
