An administrator would like to use the VMware Certificate Authority (VMCA) as an Intermediate Certificate Authority (CA). The first two steps performed are: -Replace the Root Certificate -Replace Mach

Solution User Certificates must be replaced using the Intermediate CA option so that service-to-service authentication certificates are signed by the new intermediate CA and chain back correctly to the updated trust anchor. Skipping this step would leave solution users with certificates not aligned to the new PKI hierarchy.

There is no 'Intermediate CA' variant for replacing the VMware Directory Service Certificate - that step uses a standard replacement procedure separate from the intermediate CA signing path.

The VMware Directory Service (vmdir) certificate is a special certificate used for LDAP replication and directory authentication, and it has its own dedicated replacement procedure. Unlike machine and solution user certificates, its replacement step does not carry an 'Intermediate CA' designation in the Certificate Manager workflow.

Replacing Solution User Certificates without the Intermediate CA designation would sign them under the default VMCA root rather than the new intermediate CA, creating an inconsistent and broken certificate chain.