• Configure the certificates of your vCenter and ESXi hosts as described in VMware's security documentation, using certificates from your organization's certificate authority or a public certificate authority.
   

• Your VMware administrator can find the procedures in VMware's documentation:

  vCenter: vSphere Security Certificates describes Hybrid Mode, which VMware calls "simple and secure": the vCenter's machine SSL certificate is replaced with one from your certificate authority, and VMCA continues to manage the internal and ESXi host certificates. Replacing vSphere Certificates compares the available approaches.

  Standalone ESXi host: Managing Certificates for ESX Hosts describes how to use certificates from your own certificate authority.

If you would like to use VMCA issued certificates, we recommend following VMware's security guidance to keep your VMware environment, and the systems connected to it, secure. VMware recommends keeping vCenter and ESXi hosts on an isolated management network (see About the VMware Certificate Authority).

We recommend placing the VM Backup machine in that network, and using that VM Backup installation only for virtual machines on hosts within it. This keeps VM Backup's VMware connections within the network that VMware intends for management traffic.

Note: make sure that you are adding root certificate not an intermediate certificate.
 

You can follow the steps below:

1. On the VM Backup machine, use Chrome with administrator rights, type the address of the host you will add to VM Backup, starting with https://:
    
   • vCenter: https://<vcenter>/, for example https://vcenter.example.com/
   • standalone ESXi host: https://<esxi>/
     
     Take note of the Root certificate thumbprint shown here.
      

2. Click Not secure › Certificate details and read Issued By on the General tab.
    

3. For vCenter installations "Issued by" will show as CA
    

   • In Chrome, open https://<vcenter>/afd/vecs/ca

   • If Chrome warns "Your connection is not private", click Advanced › Proceed. Chrome saves the file as ca.cer in Downloads.
      

4. For standalone ESXi hosts
    
   • In Chrome, on https://<esxi>/, click Not secure › Certificate details › Details.
   • Under Certificate Hierarchy, select the top entry, VMware Installer. If the hierarchy shows only one entry, the host's name, stop: see the warning above.
   • Click Export… and save it as ca.cer in Downloads.

   • The ESXi certificate must also be issued for the host's name. If Issued To on the General tab is localhost.localdomain or a different name, VM Backup does not accept the host even after these steps. The ESXi administrator must first set the host's name and regenerate the certificate.
      

5. Check the thumbprint. Double-click ca.cer. On General, Issued To must be the certificate authority (for example CA), not the host's name. Open Details and select Thumbprint. Compare it with the value from the VMware administrator. Do not continue if it differs.
    

6. Install it into Local Machine › Trusted Root Certification Authorities:
    

   1. In the certificate window from step 1, click Install Certificate….

   2. Store Location: select Local Machine (default is Current User). Click Next and accept the administrator prompt.

   3. Select Place all certificates in the following store (default is automatic). Click Browse… and choose Trusted Root Certification Authorities.

   4. Click Next, then Finish. Windows shows "The import was successful."
       

7. To confirm successful installation, double-click ca.cer again. The red cross and "not trusted" message are gone, and Certification Path shows "This certificate is OK."
    

8. Turn off revocation checking. VMCA does not publish revocation information, so VM Backup does not accept VMCA certificates until revocation checking is explicitly turned off. This is done with a small settings file, SecurityOptions.altj
   
   Note: revocation checking will be disabled for all HTTPS connections made by this specific VM Backup insallation.
    

   1. Create the settings file C:\ProgramData\Hornetsecurity\VMBackup\Options\SecurityOptions.altj with this content:
      
      { "CheckCertificateRevocationList": false }
      
      In Notepad (run as administrator), choose Save as type: All files so that Notepad does not add .txt. Create the Options folder if it does not exist.
       

   2. Restart all Hornetsecurity services
       

   3. Confirm that the host is now able to connect, or attempt to connect your vCenter/ESXi if it has not been added already. Use the host's host name, not its IP address, unless the certificate also lists the IP address.

We recommend placing the VM Backup machine in the same network, and using that VM Backup installation only for virtual machines on hosts within it. This keeps VM Backup's VMware connections within the network that VMware intends for management traffic.

1. For standalone ESXi hosts
    
   • In Chrome, on https://<esxi>/, click Not secure › Certificate details › Details.
   • Under Certificate Hierarchy, select the top entry, VMware Installer. If the hierarchy shows only one entry, the host's name, stop: see the warning above.
   • Click Export… and save it as ca.cer in Downloads.

   • The ESXi certificate must also be issued for the host's name. If Issued To on the General tab is localhost.localdomain or a different name, VM Backup does not accept the host even after these steps. The ESXi administrator must first set the host's name and regenerate the certificate.
      

2. Check the thumbprint. Double-click ca.cer. On General, Issued To must be the certificate authority (for example CA), not the host's name. Open Details and select Thumbprint. Compare it with the value from the VMware administrator. Do not continue if it differs.
    

3. Install it into Local Machine › Trusted Root Certification Authorities:
    

   1. In the certificate window from step 1, click Install Certificate….

   2. Store Location: select Local Machine (default is Current User). Click Next and accept the administrator prompt.

   3. Select Place all certificates in the following store (default is automatic). Click Browse… and choose Trusted Root Certification Authorities.

   4. Click Next, then Finish. Windows shows "The import was successful."
       

4. To confirm successful installation, double-click ca.cer again. The red cross and "not trusted" message are gone, and Certification Path shows "This certificate is OK."

The Offsite Backup Server connects to VMware hosts for replication. From version 9.22, it applies the same certificate policy as VM Backup, so the same resolutions apply on the Offsite Backup Server machine. The settings of VM Backup and the Offsite Backup Server are separate: changes on the VM Backup machine do not affect the Offsite Backup Server.

The above resolutions apply for the Offsite Backup Server as well. The recommended resolution is naturally the preferred solution, especially if the Offsite Backup Server is available over the Internet and not just locally accessible.

If it's local only and would like to proceed with a VMCA-issued certificate, follow steps 1-7 in the Alternative section above and for step 8 create the settings file in the Offsite Backup Server's own folder, and restart its service:

• Settings file: C:\ProgramData\Hornetsecurity\OffsiteBackupServer\Options\SecurityOptions.altj, with the same content. The Options folder does not exist by default; create it.

• Restart Service: Hornetsecurity Offsite Backup Server

At this point the VMware host should connect.