This post focuses on configuring vCenter Sign-On to use a secured LDAPS connection (LDAP over SSL) when your environment utilizes a root Certificate Authority (CA) and an issuing CA in addition to the Domain Controller certificate. The official VMware Knowledge Base article ( https://knowledge.broadcom.com/external/article/316596 ) provides a general overview, but this guide details how to combine and import the necessary certificates in a chained format.

The key to successful LDAPS configuration in this scenario is importing a certificate chain containing the Domain Controller certificate, the issuing CA certificate, and the root CA certificate. This ensures that vCenter trusts the certificate presented by your domain controllers.

Here’s how to create the necessary .pem file using PowerShell:

1. Export Certificates: Obtain the Domain Controller certificate, the issuing CA certificate, and the root CA certificate in .crt or .cer format. Ensure they are accessible on your machine (e.g., c:\temp\domaincontroller.crt, c:\temp\issuingCA.crt, and C:\temp\rootca.cer).
2. Import into vCenter: During the “Add Identity Source” configuration process in vCenter, you will be prompted to browse for the certificate file. Select the ldap_chain_certificate.pem file you created.
   
   By following these steps, you can successfully configure vCenter to use a secure LDAPS connection to your Active Directory environment, even when using a multi-tiered CA infrastructure. Remember to verify the order of the certificates in the combined file (Domain Controller -> Issuing CA -> Root CA) for proper validation.
3. Combine Certificates using PowerShell: Use the following PowerShell command to concatenate the certificates into a single .pem file:
   Get-Content -Path c:\temp\domaincontroller.crt, c:\temp\issuingCA.crt, C:\temp\rootca.cer -Raw | Set-Content -PassThru -Path C:\temp\ldap_chain_certificate.pem
   -Path: Specifies the path to each certificate file. Ensure the order is correct: Domain Controller -> Issuing CA -> Root CA.
   -Raw: Reads the entire content of each file as a single string.
   -Encoding utf8: Specifies the output file encoding. Use utf8 to ensure broad compatibility
   -Path (Set-Content): Specifies the output path for the combined certificate chain file ( ldap_chain_certificate.pem).