Which three options are available for replacing vCenter Server Security Certificates? (Choose three.)

Replacing certificates with VMCA-signed ones is the default supported option, where VMCA acts as the root CA and signs all solution and machine certificates in the environment.

Making VMCA an intermediate CA allows an enterprise or third-party root CA to sit above VMCA in the chain, satisfying corporate PKI policies while still leveraging VMCA for internal certificate distribution.

Administrators can fully bypass VMCA and provision all certificates from an external CA, giving complete control over the certificate chain to match enterprise security requirements.

SSL Thumbprint mode is a legacy ESXi host connection mode for bypassing certificate verification, not a certificate replacement strategy for vCenter Server.

Replacing VMCA-issued certificates with self-signed certificates is not a supported or recommended workflow - self-signed certs outside VMCA introduce unmanaged trust anchor issues.