Configured vCenter as subordinate CA

Products

• VMware vCenter Server

Issue/Introduction

• When we need to use one click option for renewing custom CA signed certificate for ESXi from vCenter UI. 
• To achieve this, we need to make vCenter CA i.e. VMCA as subordinate CA for the internal CA used

Environment

vSphere 8.x

Resolution

• To configure vCenter as subordinate CA, we will need to replace VMCA root certificate using the internal CA used
• To replace VMCA Certificate with a custom CA Certificate use Option 2 of certificate manager
• Refer following document and kb for same 
  Replace VMCA Root Certificate with Custom Signing Certificate and Replace All Certificates Using the Certificate Manager
  Using vSphere Certificate Manager to Replace SSL Certificates

Note : Ensure you have either a valid backup of vCenter or non memory snapshot (offline snapshot of nodes in case ELM is configured) of vCenter appliance VM. 

Additional Information

Refer following pdf for more details on same Configuring vSphere Intermediate/Subordinate CA Mode