How default certificates work

The ESXi host uses automatically generated certificates that are created as part of the installation process. These certificates are unique and make it possible to begin using the server, but they are not verifiable and they are not signed by a trusted, well-known certificate authority (CA).
Using default certificates might not comply with the security policy of your organization. If you require a certificate from a trusted certificate authority, you can replace the default certificate.

Things to consider

• If the host has Verify Certificates enabled, replacing the default certificate might cause vCenter Server to stop managing the host. If the new certificate is not verifiable by vCenter Server, you must reconnect the host using the vSphere Client.
• ESXi supports only X.509 certificates to encrypt session information sent over SSL connections between server and client components.
• For information about replacing default certificates on a vCenter Server system, see the vSphere Examples and Scenarios documentation.
• All file transfers and other communications occur over a secure HTTPS session. The user used to authenticate the session must have the privilege Host.Config.AdvancedConfig on the host

Procedure

• Log in to the ESXi Shell and acquire root privileges.
• In the directory /etc/vmware/ssl, rename the existing certificates using the following commands.

mv rui.crt orig.rui.crt
mv rui.key orig.rui.key

• Copy the new certificate and key to /etc/vmware/ssl.
• Rename the new certificate and key to rui.crt and rui.key.
• Restart the host after you install the new certificate.
• Alternatively, you can put the host into maintenance mode, install the new certificate, and then use the Direct Console User Interface (DCUI) to restart the management agents.

See Pages

71-73 of the vSphere 5 Security Guide

32-36 VMware vSphere Examples and Scenarios