VMware ESXi and vSphere Cluster Management

Install vSphere Web Client Separately with Custom Install

Learn how to install the legacy vSphere Web Client on a separate Windows Server, register it with vCenter SSO, verify certificates, and validate vCenter and ESXi access.

The legacy vSphere Web Client is a browser-based management interface for vCenter Server. After signing in, administrators can manage vCenter inventory, ESXi hosts, virtual machines, clusters, datastores, permissions, and other vSphere resources.

The browser is only the client side. In this deployment model, the Web Client server component is installed on a supported Windows Server. It communicates with vCenter services and vCenter Single Sign-On (SSO), while administrators connect to it through a web browser.

When to Use a Separate Web Client Installation

Legacy vCenter releases commonly offered several deployment models. The correct choice depends on the release, the supported operating systems, resource planning, and whether the architecture requires separate servers.

Simple Install: Places vCenter Single Sign-On, Inventory Service, vCenter Server, and the vSphere Web Client together in an all-in-one Windows deployment. It is suitable for smaller or less distributed environments when the release supports this option.

Custom Install: Installs vCenter components separately. For example, SSO can run on one supported server, vCenter Server on another, and the Web Client on a separate Windows Server.

vCenter Server Appliance: Provides vCenter services as part of a preconfigured appliance deployment. A separate Windows Web Client installation is not normally required in this model.

A separate Web Client is appropriate when you need component separation, independent resource allocation, a distributed vCenter design, or a dedicated host for browser-based administration. It is not a standalone replacement for vCenter Server: the Web Client depends on vCenter services and is not a direct replacement for every host-level management method.

For background, review vCenter Server Simple Install and vCenter SSO deployment modes.

How the Components Work Together

vCenter Server is the central management platform for ESXi hosts and virtual infrastructure. vCenter Single Sign-On authenticates users and services. In many legacy deployments, the internal SSO domain is vsphere.local.

The Lookup Service is a service-discovery endpoint. The Web Client uses it to locate SSO and other registered vSphere services. During installation, the Web Client is registered against the Lookup Service using an SSO administrative identity.

A typical distributed layout is:

Administrator browser
        |
        | HTTPS
        v
Dedicated Windows Web Client host
        |
        | Lookup Service and SSO registration
        v
SSO host ---- vCenter Server ---- ESXi hosts

Prerequisites and Planning

Use the installation media and compatibility guidance for the exact legacy vSphere release. Component versions must be compatible across vCenter Server, SSO, Inventory Service, and the Web Client. Do not assume that installers from different releases can be mixed.

Supported Windows Server host: Confirm that the target operating system and its patch level are supported for the Web Client release. Use an account with permission to install services and write to the selected directory.

Matching installation media: Obtain the installer for the same vCenter Server release and keep the release-specific VMware interoperability guidance available.

Working SSO deployment: SSO must be operational before the Web Client is installed and registered.

DNS and network connectivity: Confirm forward and reverse name resolution where required, routing, firewall access, and reliable communication between the Web Client, SSO, Lookup Service, and vCenter hosts.

Time synchronization: Synchronize clocks between participating systems. Significant time differences can cause certificate and authentication failures.

Available ports: Identify the Web Client HTTP and HTTPS listener ports selected during setup. Ensure that no other service is using them.

Credentials: Have an authorized SSO administrator account, commonly in the form <administrator-account>@vsphere.local.

Certificate fingerprint: Obtain the expected SSO Lookup Service certificate fingerprint from a trusted source before starting.

Storage and permissions: Select an installation directory with sufficient disk space and appropriate permissions.

Information to Collect Before Installation

Target host name and FQDN: Record the Windows Server name and fully qualified domain name.

Installation folder: Decide where the Web Client binaries and supporting files will be installed.

HTTP port: Choose an unused HTTP listener port if the release requires one.

HTTPS port: Choose the unused secure listener port that administrators will use in the browser.

SSO administrator username and password: Use an account with the privileges required for service registration.

Lookup Service URL: Prepare the release-appropriate endpoint, commonly following this pattern:

https://<sso-host-fqdn-or-ip>:7444/lookupservice/sdk

For example, an SSO host named sso.example.local may use https://sso.example.local:7444/lookupservice/sdk. Confirm the port and path against the specific legacy release. Prefer an FQDN that matches the SSL certificate identity.

Check DNS, Ports, and Connectivity

Run these checks from the Web Client Windows host. Replace placeholders with your environment's values.

nslookup <sso-host-fqdn>
Test-NetConnection <sso-host-fqdn> -Port 7444
netstat -ano | findstr :<port>

nslookup tests name resolution. Test-NetConnection tests TCP reachability to the Lookup Service port in PowerShell. netstat helps determine whether a planned Web Client listener port is already bound.

Custom Installation Workflow

  1. Log on to the target Windows Server with an account that can install applications and create or modify services.
  2. Mount or otherwise access the matching vCenter Server installation media, then launch the vCenter installer.
  3. Select the vSphere Web Client component. Do not select the all-in-one Simple Install option when the goal is a separate component.
  4. Select the installer language and accept the license terms.
  5. Choose the destination folder. Confirm that the drive has sufficient space and that the installer account can write to the folder.
  6. Enter the Web Client connection settings, including the HTTP and HTTPS listener ports. Select ports that are unused and approved by the network design.
  7. Provide the SSO administrator username and password.
  8. Enter the SSO Lookup Service URL, such as https://sso.example.local:7444/lookupservice/sdk when that pattern matches the release and environment.
  9. Review the SSL certificate fingerprint displayed by the installer. Compare it with a fingerprint obtained from a trusted SSO administrator or another trusted source.
  10. Accept or install the required certificates only after the identity of the Lookup Service endpoint has been verified.
  11. Review the summary and start the installation. Allow the installer to create services, register the Web Client, and initialize its configuration.
  12. When setup completes, note the configured HTTPS port and open the Web Client endpoint in a supported browser:
https://<web-client-host>:<configured-https-port>/
  1. Sign in with an authorized SSO-backed account.
  2. Confirm that the intended vCenter Server appears and that its ESXi inventory can be viewed.

Understanding Lookup Service Registration

The Lookup Service lets vSphere components discover one another instead of relying on manually entered addresses for every service. The URL normally contains four important parts:

  • HTTPS: Secure transport is used for the registration and service-discovery connection.
  • SSO server name or address: Prefer the SSO FQDN that corresponds to the certificate identity.
  • Lookup Service port: In the applicable legacy architecture, this is commonly 7444.
  • SDK path: The commonly used path is /lookupservice/sdk.

The SSO administrative credentials are required because the installer must register the Web Client with the vSphere service infrastructure. Registration is separate from the later authorization of individual vCenter users.

Certificate Trust and Security Review

An SSL certificate fingerprint is a compact identifier for a certificate. The installer displays it so that you can verify that the endpoint presenting the certificate is the intended SSO Lookup Service.

  1. Obtain the expected fingerprint through a trusted administrative channel.
  2. Compare the expected value with the installer prompt, taking the displayed formatting into account.
  3. Investigate any mismatch before continuing. Check DNS, certificate replacement, the selected hostname, and possible intermediary SSL devices.
  4. Accept the certificate or install it into the required trust store only when the endpoint and fingerprint are trusted.

Post-Installation Validation

  1. Open the Windows service management console and verify that the Web Client-related services are running. Service names vary by legacy release.
  2. Browse to https://<web-client-host>:<configured-https-port>/.
  3. Confirm that the browser reaches the expected HTTPS service without a certificate warning.
  4. Sign in with an authorized account from the configured SSO domain.
  5. Verify that the intended vCenter Server is visible.
  6. Open the inventory and confirm that the expected datacenters, clusters, ESXi hosts, and virtual machines are present.
  7. Confirm both communication paths: browser to Web Client, and Web Client to SSO and vCenter services.

Inventory visibility does not automatically grant management rights. If a user can authenticate but cannot perform an operation, review vCenter permissions and roles. See assigning permissions for the authorization side of the configuration.

Common Installation and Access Problems

Lookup Service connection failure: The URL may be malformed, DNS may fail, TCP access may be blocked, or SSO and Lookup Service processes may be stopped. Recheck the URL, run nslookup and Test-NetConnection, and inspect firewalls and routing.

Certificate fingerprint mismatch: The hostname may resolve to the wrong system, the certificate may have been replaced, or an SSL intermediary may be involved. Do not accept the certificate until the discrepancy is explained.

Port already in use: Another web server, monitoring agent, or previous vSphere component owns the listener. Identify the process with netstat -ano, then stop or reconfigure it when appropriate, or choose an approved unused port.

SSO authentication failure: Check the username format, password, SSO domain, account status, required privileges, and system time synchronization.

Web Client page unavailable: Check Web Client services, the configured HTTPS port, Windows Firewall, network firewalls, and service logs for startup or certificate errors.

vCenter inventory not visible: Confirm registration with the intended SSO domain and vCenter environment, check vCenter availability, review permissions, and verify component compatibility and service-registration health.

What This Installation Does Not Install

  • The Web Client does not replace the desktop vSphere Client.
  • The VMware Client Integration Plug-in is a separate, optional client-side component for supported legacy browser workflows.
  • The Web Client does not remove the need for vCenter Server when managing vCenter inventory.
  • The Web Client is not a direct replacement for every ESXi host-level management method.

Exam-Relevant Notes

  • Simple Install is the all-in-one Windows model; Custom Install separates vCenter components.
  • A standalone Web Client requires a supported Windows Server host and a previously operational SSO deployment.
  • The Lookup Service URL commonly uses HTTPS, port 7444, and /lookupservice/sdk in the applicable legacy architecture.
  • Verify the Lookup Service certificate fingerprint before trusting it.
  • Successful installation requires both service availability and correct SSO registration; a running Web Client alone does not prove that vCenter inventory access works.
  • The vCenter Server Appliance normally packages the relevant vCenter services, so a separate Windows Web Client installation is not normally needed.

Final Checklist

  • Supported Windows Server and matching vCenter release media are available.
  • SSO, Lookup Service, and vCenter Server are operational and version-compatible.
  • FQDN resolution, routing, time synchronization, and firewall rules are verified.
  • Installation directory, HTTP port, HTTPS port, SSO credentials, and Lookup Service URL are documented.
  • The displayed certificate fingerprint matches a trusted value.
  • Web Client services start successfully.
  • The HTTPS URL opens, SSO login succeeds, and the expected vCenter and ESXi inventory are visible.