vSphere Server
Certificates
The VMware vSphere API is available as a secure Web service.
Secure Web service means that, by default, ESXi and vCenter Server are configured for HTTPS and
support SSL to encrypt communications. This appendix explains how to manage the certificates
needed for secure communications.
Secure Client-Server Communications To connect to the server using HTTPS, client applications must verify the identity of the server by using the server’s certificate during an initial handshake. The client must obtain the server certificate in advance, so that it is available during the handshake. Simplified Security Setup for Development Environment You can bypass certificate checking while developing software in a non-production environment. To do this, create a custom implementation of the javax.net.ssl.TrustManager interface that returns true rather than actually verifying certificates during the SSL handshake. You can see examples of such a class in the Java code samples included with the vSphere Web Services SDK. Obtaining Server Certificates VMware products use standard X.509 version 3 (X.509v3) certificates to encrypt session information sent over SSL connections between server and client systems. When a client application initiates an SSL session with the server, the server sends its certificate to the client application, which checks the X.509 certificate against a list of known Certificate Authorities (CAs) to verify the authenticity of the certificate. The client then uses the server’s public key contained in the X.509 certificate to generate a random symmetric key, which it uses to encrypt all subsequent communications.