Disabling TLSv1.0 and enabling TLSv1.1 and/or TLSv1.2 will be a multi-phase process in a vSphere environment:

The TLS Reconfiguration Utility is delivered with two components to cover managing the TLS protocols for vCenter Server, vSphere Update Manager and the Platform Services Controller with the VcTlsReconfigurator component and ESXi hosts and clusters with the EsxTlsReconfigurator component. These components are located in these directories:

1. Go to customerconnect.vmware.com for vSphere.
2. Using the Select Version drop-down menu, select your version of vSphere.
3. Download the following depending on the use of Windows or Appliance in the environment.
   
   vSphere 6.5 and later
   
   For vCenter Server for Windows: VMware-vSphereTlsReconfigurator-6.5.0-4635484.x86_64.msi
   For vCenter Server Appliance: VMware-vSphereTlsReconfigurator-6.5.0-4635484.x86_64.rpm
   
   For vSphere 6.5 Update 1 and later
   
   For vCenter Server for Windows: VMware-vSphereTlsReconfigurator-6.5.0-5597882.x86_64.msi
   For vCenter Server Appliance: VMware-vSphereTlsReconfigurator-6.5.0-5597882.x86_64.rpm
    
4. Upload the file to vCenter Server and/or Platform Services Controller:
   
   For the vCenter Server Appliance and Platform Services Controller Appliance, use an SCP client to upload the file.
   For Windows vCenter Server or Windows Platform Services Controller, copy the appropriate file.

• For vCenter Server for Windows:
  1. On the Windows Server running vCenter Server, log in as an administrative user.
  2. Install the MSI file.
  3. Locate the msi file, substituting the xxxxxxx for the appropriate build: VMware-vSphereTlsReconfigurator-6.5.0-xxxxxxx.x86_64.msi
• For vCenter Server Appliance:
  1. Connect to the vCenter Server Appliance with an SSH session and root credentials.
  2. Run this command to enable the Bash shell:

3. In the Bash shell, locate the directory where the VMware-vSphereTlsReconfigurator-6.5.0-xxxxxxx.x86_64.rpm was uploaded.
4. Run the below rpm command, substituting the xxxxxxx for the appropriate build:
   
   rpm -Uvh VMware-vSphereTlsReconfigurator-6.5.0-xxxxxxx.x86_64.rpm

1. vSphere Update Manager
2. vCenter Server
3. ESXi hosts
4. Platform Services Controller

1. Connect to the Windows Server.
2. Open an administrative command prompt.
3. Change directory to the vSphereTlsReconfigurator using this command:
   
   cd C:\Program Files\VMware\CIS\vSphereTlsReconfigurator\
    
4. Manually back up all of the configurations for all supported services on vCenter Serverand Platform Services Controller:
   
   Note: The TLS Reconfigurator Utility will perform a backup operation each time a modification against the vCenter Server, Platform Services Controller or vSphere Updater Manager has been executed. Use this process only if you need to create a backup to a specific user directory.
    
   1. Change directory to the VcTlsReconfigurator using this command:
      
      cd VcTlsReconfigurator
       
   2. Execute this command to perform a backup:
      
      directory_path\VcTlsReconfigurator> reconfigureVc backup
      
      By default, this will output to this directory:
      
      c:\users\<current user>\appdata\local\temp\<year><month><day>T<time></time>
      
      To output to a specific directory, run this command
      
      directory_path\VcTlsReconfigurator> reconfigureVc backup -d <backup directory path>
       
   3. A successful backup will look like this:
      
      vCenter Transport Layer Security reconfigurator, version=6.5.0, build=4635484
      For more information refer to the following article: https://kb.vmware.com/kb/2147469
      Log file: "C:\ProgramData\VMware\vCenterServer\logs\vSphere-TlsReconfigurator\VcTlsReconfigurator.log".
      ================= Backing up vCenter Server TLS configuration ==================
      Using backup directory: c:\users\<username>\appdata\local\temp\20161108T161539
      Backing up: vspherewebclientsvc
      Backing up: vmware-autodeploy-waiter
      Backing up: rhttpproxy
      Backing up: VMwareSTS
      Backing up: vsphere-ui
      Backing up: VMWareDirectoryService
      Backing up: VMWareCAMService
       
5. Update all of the configuration for all supported services on the vCenter Server. Once the chosen command has been run, the vCenter Server will require a reboot.
   
   Note: For products communicating to the vCenter Server which still require TLSv1.0 to be enabled, this will cease connectivity.
    
   1. Disable TLSv1.0 on the vCenter Server, and enable a higher versions of TLSv1.x.
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path\VcTlsReconfigurator> reconfigureVc update -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path\VcTlsReconfigurator> reconfigureVc update -p TLSv1.2
         
   2. Repeat this on remaining vCenter Server.
       
6. Update the configuration for all supported services on the ESXi hosts managed by each of the vCenter Servers:
    
   1. Change directory to the EsxTlsReconfigurator using this command:
      
      cd ..\EsxTlsReconfigurator
       
   2. Disable TLSv1.0 on the ESXi hosts, and enable a higher versions of TLSv1.x. This can be done either on a per-host or per-cluster bases in addition to disabling TLSv1.0 and enabling TLSv1.1 and TLSv1.2 or disabling TLSv1.0 and enabling only TLSv1.2.
      
      Note: If --protocol or -p is not included, this will default to TLSv1.2 only
       
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2 on an individual ESXi host inside of vCenter Server, execute this command to perform a reconfiguration:
        
        directory_path\EsxTlsReconfigurator> reconfigureEsx vCenterHost -h <ESXi_Host_Name> -u <Administrative_User> -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2 on an individual ESXi host inside of vCenter Server, execute this command to perform a reconfiguration:
        
        directory_path\EsxTlsReconfigurator> reconfigureEsx vCenterHost -h <ESXi_Host_Name> -u <Administrative_User> -p TLSv1.2
         
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2 on an vCenter Server Host Cluster, execute this command to perform a reconfiguration:
        
        directory_path\EsxTlsReconfigurator> reconfigureEsx vCenterCluster -c <Cluster_Name> -u <Administrative_User> -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2 on an vCenter Server Host Cluster, execute this command to perform a reconfiguration:
        
        directory_path\EsxTlsReconfigurator> reconfigureEsx vCenterCluster -c <Cluster_Name> -u <Administrative_User> -p TLSv1.2
         
   3. Once completed, the hosts will be flagged for reboot. Reboot the ESXi hosts in order to complete the TLS protocol changes.
       
   4. Repeat this on the next cluster or ESXi host within the managing vCenter Server as appropriate.

7. Update all of the configuration for all supported services on the Platform Services Controller:
   
   Note: If you have older 6.0.x or 5.5.x vCenter Servers still connected to the Platform Services Controller, this step will cause the vCenter Servers to stop communicating to the PSC. Only proceed with this step after confirming that all vCenter Servers are running a compatible version.
    
   1. Change directory to the VcTlsReconfigurator using this command:
      
      cd C:\Program Files\VMware\CIS\vSphereTlsReconfigurator\VcTlsReconfigurator
       
   2. Disable TLSv1.0 on the Platform Services Controller, and enable a higher versions of TLSv1.x.
      
      Note: If --protocol or -p is not included, this will default to TLSv1.2 only
       
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path\VcTlsReconfigurator> reconfigureVc update -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path\VcTlsReconfigurator> reconfigureVc update -p TLSv1.2
         
   3. Repeat this operation on the remaining Platform Services Controller in the vSphere domain.

1. Connect to the vCenter Server Appliance using an SSH session.
2. Run this command to enable the Bash shell:
   
   shell
    
3. In the Bash shell, change directories to this directory:
   
   cd /usr/lib/vmware-vSphereTlsReconfigurator/
    
4. Manually backup all of the configurations for all supported services on the vCenter Server and Platform Services Controller:
   
   Note: The TLS Reconfigurator Utility will perform a backup operation each time it is executed. Use this process only if you need to create a backup to a specific user directory.
    
   1. Change the directory to VcTlsReconfigurator with this command:
      
      cd VcTlsReconfigurator
       
   2. Execute this command to perform a backup:
      
      directory_path/VcTlsReconfigurator> ./reconfigureVc backup
      
      By default, this will output to this directory:
      
      /tmp/<year><month><day>T<time></time>
      
      In order to output to a specific directory, use this command
      
      directory_path/VcTlsReconfigurator> ./reconfigureVc backup -d <backup directory path>
       
5. Update all of the configuration for all supported services on the vCenter Server and vSphere Update Manager. Once the chosen command has been run, the vCenter Server will require a reboot.
   
   Note: If you have products communicating to the vCenter Server which still require TLSv1.0 to be enabled, this will cease connectivity.
    
   1. Disable TLSv1.0 on the vCenter Server, and enable a higher versions of TLSv1.x.
       
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path/VcTlsReconfigurator> ./reconfigureVc update -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path/VcTlsReconfigurator> ./reconfigureVc update -p TLSv1.2
         
   2. Repeat this on the next vCenter Server as appropriate.
       
6. Update all of the configuration for all supported services on the ESXi hosts. This can be done either on a per-host or per-cluster bases in addition to disabling TLSv1.0 and enabling TLSv1.1 and TLSv1.2 or disabling TLSv1.0 and enabling only TLSv1.2.
    
   1. Change directory to the EsxTlsReconfigurator using this command:
      
      cd ../EsxTlsReconfigurator
       
   2. Disable TLSv1.0 on the ESXi hosts, and enable a higher versions of TLSv1.x. This can be done either on a per-host or per-cluster bases in addition to disabling TLSv1.0 and enabling TLSv1.1 and TLSv1.2 or disabling TLSv1.0 and enabling only TLSv1.2.
      
      Note: If --protocol or -p is not included, this will default to TLSv1.2 only
       
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2 on an individual ESXi inside of vCenter Server, execute this command to perform a reconfiguration:
        
        directory_path/EsxTlsReconfigurator> ./reconfigureEsx vCenterHost -h <ESXi_Host_Name> -u <Administrative_User> -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2 on an individual ESXi inside of vCenter Server, execute this command to perform a reconfiguration:
        
        directory_path/EsxTlsReconfigurator> ./reconfigureEsx vCenterHost -h <ESXi_Host_Name> -u <Administrative_User> -p TLSv1.2
         
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2 on an ESXi Cluster, execute this command to perform a reconfiguration:
        
        directory_path/EsxTlsReconfigurator> ./reconfigureEsx vCenterCluster -c <Cluster_Name> -u <Administrative_User> -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2 on an ESXi Cluster, execute this command to perform a reconfiguration:
        
        directory_path/EsxTlsReconfigurator> ./reconfigureEsx vCenterCluster -c <Cluster_Name> -u <Administrative_User> -p TLSv1.2
         
   3. Once completed, the hosts will be flagged for reboot. Reboot the ESXi hosts in order to complete the TLS protocol changes.
   4. Repeat this on the next cluster or ESXi host within the managing vCenter Server as appropriate.
       
7. Update all of the configuration for all supported services on the Platform Services Controller:
   
   Note: If you have older vCenter Servers 6.0.x or 5.5.x still connected to the Platform Services Controller, this step will cause the vCenter Servers to stop communicating to the PSC. Only proceed with this step after confirming that all vCenter Servers are running a compatible version.
    
   1. Change directory to the VcTlsReconfigurator using this command:
      
      cd /usr/lib/vmware-vSphereTlsReconfigurator/VcTlsReconfigurator
       
   2. Disable TLSv1.0 on the Platform Services Controller, and enable a higher versions of TLSv1.x.
      
      Note: If --protocol or -p is not included, this will default to TLSv1.2 only
       
      • To disable TLSv1.0 and enable both TLSv1.1 and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path\VcTlsReconfigurator> ./reconfigureVc update -p TLSv1.1 TLSv1.2
         
      • To disable TLSv1.0 and TLSv1.1, and enable only and TLSv1.2, execute this command to perform a reconfiguration:
        
        directory_path\VcTlsReconfigurator> ./reconfigureVc update -p TLSv1.2
         
   3. Repeat this operation on the remaining Platform Services Controller in the vSphere domain.

1. vSphere Update Manager
2. vCenter Server
3. Platform Services Controller

1. Connect to the Windows Server.
2. Open an administrative command prompt.
3. Change directory to the vSphereTlsReconfigurator using this command:
   
   cd C:\Program Files\VMware\CIS\vSphereTlsReconfigurator\VcTlsReconfigurator
    
4. Review the previous backups taken using the below commands:
   
   C:\ProgramData\VMware\vCenterServer\logs\vSphere-TlsReconfigurator\VcTlsReconfigurator.log
   
   Use the below output as an example:
   
   c:\users\<username>\appdata\local\temp\20161108T161539
   c:\users\<username>\appdata\local\temp\20161108T171539
    
5. Manually run the below command to perform a restore:
   
   directory_path\VcTlsReconfigurator> reconfigureVc restore -d <Directory Path from Step 4>
   
   Use the below output as an example:
   
   directory_path\VcTlsReconfigurator> reconfigureVc restore -d c:\users\<username>\appdata\local\temp\20161108T171539
   
    
6. Repeat this operation accordingly on the remaining vCenter Servers
7. Repeat this operation accordingly on all Platform Services Controllers