Which three options are available for ESXi Certificate Replacement? (Choose three.)

VMware Certificate Authority (VMCA) mode is the default certificate mode in vSphere where VMCA automatically provisions and manages SSL certificates for ESXi hosts. All host certificates are signed directly by the VMCA root and are automatically renewed as needed.

Custom Certificate Authority mode allows administrators to replace ESXi host certificates with certificates signed by an enterprise or third-party CA, removing VMCA from the trust chain entirely. This mode is used when organizations require certificates issued from their own PKI infrastructure.

Thumbprint mode is a legacy certificate mode retained for backward compatibility in which ESXi host certificates are identified and validated by their SHA1 thumbprint rather than by a full certificate chain. This mode bypasses standard chain validation and is not recommended for production environments.

Hybrid Deployment is not a defined ESXi certificate replacement mode and does not appear as an option in the vSphere Certificate Manager tool or official VMware documentation.

VMware Certificate Endpoint Authority Mode does not exist as a named certificate mode in vSphere and is not found in any VMware certificate management documentation.