Which two statements are correct regarding vSphere certificates? (Choose two.)

ESXi host upgrades do preserve the existing SSL certificate rather than reissuing one - this statement is the direct factual contradiction of correct answer B.

When an ESXi host is upgraded, the existing SSL certificate issued by VMCA is preserved and not replaced, ensuring continuity of trust relationships and preventing unnecessary certificate re-provisioning workflows.

During initial provisioning or addition to a vCenter environment, ESXi hosts are issued SSL certificates signed by the VMware Certificate Authority (VMCA), integrating the host into the vSphere certificate trust hierarchy managed by vCenter.

While standalone ESXi hosts generate self-signed certificates at initial installation, once managed by vCenter they receive VMCA-signed certificates, making the characterization of self-signed as the default inaccurate in a managed vCenter environment.