Replace Certicate Auth on VSPHERE/VCENTER with own custom certificate

vsphere-vcenter-ca-update.txt

upload your CA certificate + key to the vcenter server

i.e. 
scp ./yourca.crt root@vcenter.server.host:/
scp ./yourca.key root@vcenter.server.host:/

ssh to vcenter server

run /usr/lib/vmware-vmca/bin/certificate-manager

SELECT option #2  "Replace VMCA Root certificate with Custom Signing Certificate and replace all Certificates"
SELECT Yes to generate all certificates
Enter username/password to vcenter administrator account (administrator@vsphere.local is default)

Answer questions for certificate.
When asked to either 

1. Generate Certificate Signing Request(s) and Key(s) for VMCA Root Signing certificate
2. Import custom certificate(s) and key(s) to replace existing VMCA Root Signing certificate

Select Option #2

and provide file names for certificate and key, i.e. where you scp'ed them. in the example above the paths would be
/yourca.crt
/yourca.key

Select Yes to continue operation and wait for the process to finish - 
it will replace the CA with the one you uploaded and regenerate certificates for all services

In VSphere Web Client you can then replace certificates on your ESXI hosts with certificates generated with the CA you installed.