Which two statements are correct regarding vSphere certificates? (Choose two.)

This statement is incorrect - ESXi host upgrades preserve the existing certificate rather than reissuing a new one from VMCA, maintaining continuity of secure management connections.

ESXi host upgrades preserve the existing SSL certificate rather than issuing a new one, ensuring that trust relationships, certificate pinning, and management connectivity are not disrupted by the upgrade process. This behavior prevents the need for re-trust operations across vCenter and any external tools that have pinned the host certificate after an upgrade.

When an ESXi host is provisioned or added to a vCenter Server environment, VMCA automatically generates and assigns a signed SSL certificate to the host as part of the default certificate management workflow introduced in vSphere 6.0. This replaces the older model of purely self-signed certificates and centralizes certificate authority management under VMCA.

ESXi hosts managed by a vCenter Server receive VMCA-signed certificates by default rather than purely self-signed certificates, which was the pre-vSphere 6.0 behavior before VMCA was introduced.