Auto-Deploy: VMware vSphere

Use automatic deployment to have the toolkit provision the replacement scanner VM on VMware vSphere for you as part of the replacement.

To deploy the replacement scanner VM on VMware vSphere automatically:

1. Select VMware vSphere as the target platform.
2. Check Deploy for me.
3. Complete the deployment form, described in the following tables.

vCenter Connection

Provide the vCenter Server connection details:

vCenter certificate

Every connection to vCenter checks the server's TLS certificate in one of three modes (the vCenter certificate selector under the password field):

• Verify (public or company CA) — default. The certificate chain must verify against the system CA bundle and match the host you connect to.
• Trust this vCenter's certificate — for vCenters using a self-signed certificate or an internal VMware CA (VMCA). Click Fetch certificate; the toolkit connects to the vCenter, shows the certificate's subject, issuer, validity, and SHA-256 fingerprint. Compare the fingerprint with the one shown in vCenter (Administration → Certificates) or ask your vCenter administrator, then click Trust. The certificate — public data, not a credential — is remembered per vCenter host and survives reconnects; you can remove it any time with Remove.
• Don't verify (not recommended) — skips certificate checks. Your vCenter password could be intercepted on the network; use only as a last resort.

Trusted certificates are stored with the toolkit's data (the data directory); they are public information, not credentials.

Notes:

• The host you connect to must match the certificate's names. If the certificate is issued for vcenter.example.com, connect using that FQDN — not its IP address.
• ESXi hosts: trusting the vCenter's CA certificate (VMCA root) also covers ESXi hosts whose certificates it signed. If a deployment fails verifying an ESXi host certificate, trust the VMCA root (the fetch step offers it when the vCenter presents it) or use Don't verify.
• No certificate copying is required — the fetch and trust buttons do it for you. A Paste certificate (PEM) option exists if you already have the PEM from your administrator.
• Credentials remain in memory only; they are never persisted or logged.

OVA Source

Specify where the toolkit finds the qVSA OVA file:

Mount your OVA file as a volume and select Local to avoid large downloads on every deployment. If your qVSA OVF template is already imported into a vSphere Content Library, select Content Library and provide the library name and item name instead—the toolkit validates both exist before deployment starts and clones the VM directly from the library item, which is typically faster than importing an OVA file.

Network Configuration

Configure the network settings for the new VM:

VM Sizing

For VM sizing recommendations, see Qualys Scanner Appliance Sizing.

How It Works

The toolkit uses Terraform to import the OVA file and provision the VM with the network settings, sizing, and activation code you specified. It runs the deployment in a temporary workspace and cleans up automatically once the VM is provisioned.