Certificate authority built on Microsoft AD Certificate Services. Once a suitable template exists and IIS has Basic Authentication on for CertSrv, VCF can have it sign and automatically renew certificates for its parts.
Also called Microsoft Certificate Authority.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains Microsoft CA in context, with comparison tables and the common traps.
Terms in this definition
- CA
Entity that issues digital certificates; point-to-site VPN needs one only when clients authenticate with root and client certificates, not when RADIUS or Entra ID is used.
- Certificate
Key Vault object holding an X.509 certificate, whose associated key and secret are managed alongside it.
- Once flow
A flow that executes a single time and repeats only if the pipeline is fully refreshed. It's a common choice for a first full load ahead of a change feed, and that refresh becomes dangerous once the original files no longer exist.
- Template
A golden image for deploying VMs that cannot itself be started or edited; to change one, turn it back into a VM, update it and convert again, or clone it.
- IIS
Internet Information Services, Microsoft's web server, where a Microsoft CA's CertSrv enrolment pages live. VCF cannot get certificates from that CA until Basic Authentication is switched on there.
- Basic Authentication
If a Microsoft CA's CertSrv site in IIS only offers Windows Authentication, VCF Operations gets HTTP 401 errors when asking it to sign certificates. Turning on Basic Authentication there fixes that.
- VMware Cloud Foundation
Broadcom's platform for private cloud. It unifies management of NSX, vSAN, vSphere, VCF Automation and VCF Operations as one fleet; VVF, by contrast, lacks automation and cloud management.
Related terms
- Certificate auto-renewal
Sixty days ahead of expiry, VCF Operations fleet management can replace TLS certificates automatically on components that allow non-disruptive updates, whether issued by OpenSSL, Microsoft CA or VMCA, or self-signed. Management components and each VCF Instance are enabled individually, after setting up any OpenSSL or Microsoft CA involved.
- Certification Authority Web Enrollment
Automatic certificate signing by VCF Operations depends on this Active Directory Certificate Services role, which receives its requests for a Microsoft CA. Install it alongside the Certification Authority role on one server.