An administrator is implementing a vSphere 6.x environment containing one vCenter and five ESXi hosts. The administrator has just finished deploying the vCenter Server appliance with an embedded Platf

When the VMCA root certificate is replaced first, every ESXi host added to vCenter Server afterward automatically receives a certificate signed by the updated VMCA root. This eliminates the need to manually re-issue certificates for each host post-addition, making it the lowest-effort approach when building a new vSphere environment.

SSL Thumbprint mode is a legacy fallback mechanism that does not leverage VMCA-signed certificates and does not ensure consistent PKI-based security across the environment.

Adding hosts before updating the VMCA root means all hosts initially receive certs from the old VMCA root, requiring a separate certificate renewal operation for each host afterward - increasing administrative effort.

Making VMCA an Intermediate CA requires integrating with an enterprise CA, submitting CSRs, and distributing new root trust chains - significantly more administrative effort than a simple VMCA root replacement.