Each host creates its own self-signed certificate post-installation based on the FQDN of the host. In most environments, it is considered a good practice to replace these X.509 v3 base 64 encoded SSL certificates with a certificate from a trusted certificate authority before joining the host to the vCenter Server. New options and improvements in host certificate management are described in the section on host security.