Why Settle for Red Warnings in Your Browser?
If you’ve used ESXi for a long time, you’re likely familiar with the dreaded red slashed padlock every time you log in. While it looks familiar, the NET::ERR_CERT_AUTHORITY_INVALID error is extremely annoying when working with automation or integrating monitoring systems. When I first managed a cluster of 8 ESXi hosts, I often brushed it off, thinking the internal network was safe. However, self-signed certificates are a loophole for Man-in-the-Middle (MitM) attacks if the LAN is compromised.
Modern browsers are becoming increasingly strict about security. A “legit” certificate makes your system professional and allows for smoother API calls. Instead of spending hundreds of dollars on certificates from major CAs, I will show you how to use the ACME protocol to get Let’s Encrypt for free. Everything will be automated from issuance to renewal.
Tools Preparation
ESXi runs on the BusyBox platform, so installing scripts directly on the host is a bad idea. Scripts can be wiped out after every firmware update or reboot. The best solution is to use an intermediary machine (Ubuntu or Debian VM) to run the certificate retrieval script, then push it to ESXi via SSH.
1. Install ACME.sh on the Management Machine
On your intermediary Linux machine, install acme.sh. This is currently the lightest and most powerful tool for working with Let’s Encrypt.
curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc2. Open the Door for ESXi
First, enable SSH on the ESXi host. Go to Manage > Services > TSM-SSH and click Start. Don’t forget to point a DNS record (A record) to the host’s IP, for example: esxi01.yourdomain.com.
Configuring Certificate Issuance and Deployment
Since ESXi hosts are usually located in a secure zone and don’t have port 80 open, we will use the DNS-01 Challenge. This method validates domain ownership through a TXT record, making it both easy and secure.
Step 1: Connect to the DNS Provider API
I prefer using Cloudflare because its record update speed is very fast. If you use GoDaddy or Namecheap, look up the corresponding environment variables. For Cloudflare, run the following command to export your information:
export CF_Token="your_cloudflare_api_token"
export CF_Account_ID="your_account_id"Step 2: Request a New Certificate
Run the following command to get the certificate. Replace the domain name with your actual address.
acme.sh --issue --dns dns_cf -d esxi01.yourdomain.comOnce completed, the certificate files will be located in the ~/.acme.sh/esxi01.yourdomain.com/ directory.
Step 3: Push the Certificate to the ESXi Host
ESXi stores SSL at /etc/vmware/ssl/ with two files: rui.crt and rui.key. Back up the old files before overwriting to avoid risks.
# Quick backup on ESXi
ssh root@esxi-ip "cp /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.bak && cp /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.bak"Proceed to copy the new files from the intermediary machine:
# Copy cert and key
scp ~/.acme.sh/esxi01.yourdomain.com/fullchain.cer root@esxi-ip:/etc/vmware/ssl/rui.crt
scp ~/.acme.sh/esxi01.yourdomain.com/esxi01.yourdomain.com.key root@esxi-ip:/etc/vmware/ssl/rui.keyStep 4: Apply Changes
To make ESXi recognize the new certificate without rebooting the entire server, you only need to restart the management services. This will not interrupt running virtual machines.
ssh root@esxi-ip "/sbin/services.sh restart"The web interface will lose connection for about 30 seconds. Afterward, you can log back in normally.
Check Results and Automation
Reload the ESXi management page. If you see the green padlock and information from Let’s Encrypt, you have succeeded. However, this certificate is only valid for 90 days.
The trick here is to create a small script and set up a monthly cronjob. The script will automatically issue the certificate again and scp it to the host.
# Sample script renew-esxi.sh
#!/bin/bash
acme.sh --renew -d esxi01.yourdomain.com
scp ~/.acme.sh/esxi01.yourdomain.com/fullchain.cer [email protected]:/etc/vmware/ssl/rui.crt
scp ~/.acme.sh/esxi01.yourdomain.com/esxi01.yourdomain.com.key [email protected]:/etc/vmware/ssl/rui.key
ssh [email protected] "/sbin/services.sh restart"In my experience, always use the DNS-01 challenge because it is extremely stable. You don’t have to worry about opening firewall ports or complex NAT configurations. If you manage dozens of hosts, use Ansible for bulk deployment to save a lot of time.
