[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-22。"],[],[],null,["This document shows how to get the root certificate for your vCenter server.\nThis page is for IT administrators and Operators who manage the\nlifecycle of the underlying tech infrastructure. To learn more about common\nroles and example tasks that we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nWhen a client, like Google Distributed Cloud, sends a request to your\nvCenter server, the server must prove its identity to the client by presenting\na certificate or a certificate bundle. To verify the certificate or bundle,\nGoogle Distributed Cloud (software only) for VMware must have the root certificate in\nthe chain of trust.\n\nWhen you fill in an\n[admin workstation configuration file](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/admin-workstation-configuration-file),\nyou provide the path of the root certificate in the `vCenter.caCertPath` field.\n\nYour VMware installation has a certificate authority (CA) that issues a\ncertificate to your vCenter server. The root certificate in the chain of trust\nis a self-signed certificate created by VMware.\n\nIf you do not want to use the VMWare CA, which is the default, you can configure\nVMware to\n[use a different certificate authority](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-3D0DE463-D0EC-442E-B524-64759D063E25.html).\n\nIf your vCenter server uses a certificate issued by the default VMware CA,\ndownload the certificate as follows:\n\n```\ncurl -k \"https://[SERVER_ADDRESS]/certs/download.zip\" \u003e download.zip\n```\n\nReplace \u003cvar translate=\"no\"\u003e[SERVER_ADDRESS]\u003c/var\u003e with the address of your vCenter server.\n\nInstall the `unzip` command and unzip the certificate file:\n\n```\nsudo apt-get install unzip\nunzip download.zip\n```\n\nIf the unzip command doesn't work the first time, enter the command again.\n\nFind the certificate file and a revocation file in `certs/lin`. For example:\n\n```\n457a65e8.0\n457a65e8.r0\n```\n\nIn the preceding example, `457a65e8.0` is the certificate file, and\n`457a65e8.r0` is the revocation file.\n\nYou can rename the certificate file to any name of your choice. The file\nextension can be `.pem`, but it doesn't have to be `.pem`.\n\nFor example, suppose you rename the certificate file to `vcenter-ca-cert.pem`.\n\nView the contents of `vcenter-ca-cert.pem`:\n\n```\ncat vcenter-ca-cert.pem\n```\n\nThe output shows the base64-encoded certificate. For example:\n\n```\n-----BEGIN CERTIFICATE-----\nMIIEGTCCAwGgAwIBAgIJAPW1akYrS5L6MA0GCSqGSIb3DQEBCwUAMIGXMQswCQYD\nVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZ\nFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExGTAXBgNV\n...\n0AaWpaT9QCTS31tbBgBYB1W+IS4qeMK5dz5Tko5460GgbSNLuz5Ml+spW745RbGA\n76ePS+sXL0WYqZa1iyAb3x8E3xn5cVGtJlxXu4PkJa76OtdDjqWAlqkNvVZB\n-----END CERTIFICATE-----\n```\n\nView the decoded certificate:\n\n```\nopenssl x509 -in vcenter-ca-cert.pem -text -noout\n```\n\nThe output shows the decoded certificate For example:\n\n```\nCertificate:\n Data:\n Version: 3 (0x2)\n Serial Number:\n f5:b5:6a:46:2b:4b:92:fa\n Signature Algorithm: sha256WithRSAEncryption\n Issuer: CN = CA, DC = vsphere, DC = local, C = US, ST = California, O = uphc-vc01.anthos, OU = VMware Engineering\n Validity\n ...\n Subject: CN = CA, DC = vsphere, DC = local, C = US, ST = California, O = uphc-vc01.anthos, OU = VMware Engineering\n Subject Public Key Info:\n Public Key Algorithm: rsaEncryption\n RSA Public-Key: (2048 bit)\n Modulus:\n 00:e0:39:28:9d:c1:f5:ac:69:04:3f:b0:a0:31:9e:\n 89:0b:6e:f7:1e:2b:3b:94:ac:1c:47:f0:52:2e:fa:\n 6d:52:2c:de:66:3e:4e:40:6a:58:c7:cc:99:46:81:\n ...\n 5c:d6:a9:ab:a9:87:26:0f:d2:ef:9e:a1:61:3d:38:\n 18:bf\n Exponent: 65537 (0x10001)\n X509v3 extensions:\n ...\n Signature Algorithm: sha256WithRSAEncryption\n 58:24:57:36:a4:66:fa:16:e1:82:b1:ee:a7:1a:77:db:77:6c:\n 0a:b7:2e:7a:11:ca:0b:38:21:d2:d2:ab:3c:30:82:3f:ae:22:\n ...\n ad:26:5c:57:bb:83:e4:25:ae:fa:3a:d7:43:8e:a5:80:96:a9:\n 0d:bd:56:41\n```\n\nCopy your certificate file to a location of your choice.\n\nThen when you need to provide a value for `caCertPath` in a configuration file,\nenter the path of your certificate file.\n\nFor example, in your admin workstation configuration file:\n\n```\ngcp:\n ...\nvCenter:\n ...\n caCertPath: \"/path/to/vcenter-ca-cert.pem\"\n```"]]
