Manually get a certificate authority (CA) chain

In the event you cannot automatically fetch the certificate authority chain, use one of the following browser-specific procedures to get a certificate chain used to connect securely to vCenter or, or .

The certificate chain is the root certificate and all subordinate certificates.

You can optionally use one of these procedures to connect to the following:

• vCenter or NSX

Get a Certificate Chain—Mac (Chrome and Firefox)

Use this procedure to get a certificate chain using the Chrome and Firefox browsers on Mac OS.

1. Open a Terminal window.

2. Enter the following command.

   security verify-cert -P url[:port]

   where url is the URL (including scheme) to vCenter or, or . For example:

   security verify-cert -P https://myvcenter.example.com

   If you access vCenter or, or using NAT or PAT, you can add a port as follows:

   security verify-cert -P https://myvcenter.example.com:12345

3. Save the entire certificate chain to a plaintext file.

   • Include all -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- delimiters.

   • Exclude any extraneous text (for example, the name of the certificate and any text contained in angle brackets (< and >) as well as the angle brackets themselves.

4. Repeat these tasks for vCenter, or .

Get a Certificate Chain—Windows Chrome

Use this procedure to get a certificate chain using the Chrome browser on Windows.

1. Log in to vCenter or, or using Chrome.

2. In the browser address bar, click the lock to the left of the host name.

3. Click Certificate.

4. Click the Certification Path tab.

5. Click the top (that is, first) certificate in the chain.

6. Click View Certificate.

7. Click the Details tab.

8. Click Copy to File.

9. Follow the prompts to create a CER-formatted certificate file that includes the entire certificate chain.

   When you're prompted to choose an export file format, click Base 64-Encoded X.509 (.CER) as the following figure shows.

   

10. Follow the prompts to complete the export.

11. Open the certificate in a text editor.

12. Repeat the process for all certificates in the chain.

    You must paste each certificate in the text editor in order, first to last.

13. Repeat these tasks for vCenter or, or .

Get a Certificate Chain—Windows Firefox

Use the following procedure to get a certificate chain for the Firefox browser on either Windows or Mac OS.

1. Log in to vCenter or, or . using Firefox.

2. Click the lock to the left of the host name.

3. Click the right arrow (Show connection details). The following figure shows an example.

   

4. Click More Information.

5. Click View Certificate.

6. If the resulting dialog box has tab pages, click the tab page corresponding to the top-level CA.

7. Scroll to the Miscellaneous section.

8. Click PEM (chain) in the Download row. The following figure shows an example.

   

9. Save the file.

10. Repeat these tasks for vCenter or, or .