Creating an ESXi Host Secret

Due to a limitation on the ESXi server, creating an ESXi host secret may fail with an "unable to connect" error. If this happens, check if your ESXi server supports EMS. If it does, enable EMS in the Cryptographic Security Platform Vault appliance and retry. If your ESXi server does not support EMS, you need to disable it. For details, see Configuring TLS.

  1. From the Cryptographic Security Platform Vault for Secrets webGUI, select Manage > Manage Boxes.

  2. On the Manage Boxes page, select the box where you want to create a secret.

  3. On the Box page, in the Secrets region, click Add.

  4. In the Choose a type of secret to create dialog box, select ESXi Host.

  5. On the About page of the Create Secret: ESXi Host wizard, complete the following: 

    Option Description
    Name

    Enter the name to use for the secret.

    Description Enter the optional description for the secret.
    Expires

    Select one of the following: 

    • Use Box Setting—Accepts the global box value. This is the default.

    • No Expiration—The secret does not expire.

    • Specific Date and Time—Allows you to set the specific date and time for the secret to expire.
  6. Click Continue.

  7. On the Secret page of the Create Secret: ESXi Host wizard, complete the following: 

    Option Description

    Host

    		 Enter the ESXi host address.

    User Name

    Enter the ESXI host user name.
    Password

    Enter the password for the ESXi host.
    TLS Version

    Select the TLS version used by the ESXi host.

    CA Certificate

    Click Add Certificate to specify the CA certificate to use while connecting to an ESXi host. After you add the CA certificate, there is a link to modify it.

  8. Click Continue.

  9. On the Checkout Details page of the Create Secret: ESXi Host wizard, complete the following:

    Option Description

    Checkout Duration

    How long the secret is checked out.

    • Use Box Setting—Use the duration set when creating the box. This is the default.

    • Duration—Enter a duration in days, minutes, or hours. This value will overwrite the box settings.

    Exclusive Checkout

    If enabled, then the secret checkout will be exclusive and only one user can check out the secret at a time. Users must wait for the checkout duration to expire or must manually delete the lease to make the secret available for new checkouts.

    • Use Box Setting—Use the value that was set when creating the box. This is the default.

    • Yes—If set to Yes, the secrets checkout will be exclusive.

    • No—If set to No, multiple users can checkout the secret at the same time.

  10. Click Continue.

  11. On the Rotation Details page of the Create Secret: ESXi Host wizard, complete the following:

    Option Description

    Rotation Duration

    Sets the duration for this secret to be rotated.

    • Use Box Setting—Use the duration set when creating the box. This is the default.

    • Duration—Enter a duration in days, minutes, or hours. This value will overwrite the box settings.

    Rotate on Check In

    If enabled, the secret will automatically rotate when checked in. This requires that the checkout duration is set.

    • Use Box Setting—Use the value that was set when creating the box. This is the default.

    • Yes—If set to Yes, the secret will be rotated when it is checked in.

    • No—If set to No, the secret will not be rotated when it is checked in.

    Force Rotation

    If selected, this forces the rotation of all secrets in the box. If Rotation Duration and Force Rotation are both checked, the secret will be rotated even if there are outstanding leases. If Rotate on Check In and Force Rotation are both checked, the secret will rotate when the checkout expires.

    • Use Box Setting—Use the value that was set when creating the box. This is the default.

    • Yes—If set to Yes, this forces the secret to rotate.

    • No—If set to No, the secret will not rotate.
  12. Click Create.