VMware ESXi and vSphere Cluster Management
Install vSphere Web Client Separately with the Custom Install Method
Learn how to install the legacy VMware vSphere Web Client on a separate Windows Server and connect it to an existing vCenter Single Sign-On Lookup Service.
What the vSphere Web Client Does
The vSphere Web Client is a legacy, browser-based management interface for vSphere. Because it runs in a browser, administrators can use it from supported operating systems without installing the complete management interface on every workstation.
The Web Client connects to vCenter Server. Through vCenter, administrators can view inventory, configure virtual machines, manage clusters, and administer connected ESXi hosts. It is not a direct replacement for the management interface built into an individual ESXi host. In a vCenter environment, vCenter provides centralized management and the Web Client provides the user interface.
Simple Install, Custom Install, and Appliance Deployment
Older vCenter releases commonly offered two Windows installation approaches. The choice determines where the supporting services run.
| Deployment approach | Component placement | Typical use case | Administrative complexity | Whether separate Web Client installation is needed |
|---|---|---|---|---|
| Simple Install | vCenter Single Sign-On, vCenter Inventory Service, vCenter Server, and vSphere Web Client are installed together on one Windows system. | Small environments, laboratories, or deployments where components do not need to be distributed. | Lower initial complexity because the installer supplies local component relationships. | No. The Web Client is installed as part of the combined deployment. |
| Custom Install | Core vCenter components can be installed on separate Windows systems. | Distributed architectures that require independent placement, sizing, or administrative boundaries. | Higher. DNS, certificates, ports, service dependencies, and registration must be planned. | Yes, when the Web Client is assigned to its own server. |
| vCenter Server Appliance | The principal vCenter components are bundled in a preconfigured Linux-based virtual appliance. | Deployments that use the appliance rather than separate Windows-based components. | Appliance deployment is different from the Windows Custom Install workflow. | Usually no separate Windows Web Client installation is required for the bundled architecture. |
Plan the Standalone Web Client Server
Choose a Windows Server that will host the Web Client service. The server should be supported by the vSphere release and have enough capacity for the component and its operating system. Use an account with permission to install software and create or manage Windows services.
Network and naming requirements
- Give the Web Client server a stable network identity and, preferably, a fully qualified domain name (FQDN).
- Ensure the Web Client server can resolve and reach the FQDN of the SSO server.
- Ensure the SSO server can be identified consistently by the name used in its certificate.
- Verify routing and firewall rules between the Web Client server and the SSO Lookup Service.
- Record the vCenter Server name and endpoint that the Web Client must ultimately access.
Ports, installation folder, and certificates
- Choose an installation directory with adequate space and access permissions.
- Review every service port requested by the installer. A port must not already be occupied by another application.
- Permit required traffic according to the organization's firewall policy, including traffic to the SSO Lookup Service and the Web Client endpoint.
- Plan certificate trust before installation. The installer will present the SSO certificate fingerprint for verification and may ask to install trusted certificates.
Prerequisite vCenter Services
vCenter Single Sign-On (SSO) must already be installed and operational. SSO authenticates users and participates in service discovery. The Web Client uses SSO to locate and trust the vSphere services with which it communicates.
The SSO administrator is an administrative identity in the internal vSphere SSO domain. In many legacy deployments, that domain is vsphere.local, so an administrator identity may have a form such as <administrator>@vsphere.local. Use the exact account created for the environment rather than assuming a particular user name.
The installation also requires the SSO Lookup Service endpoint. The Lookup Service registers and discovers vSphere services. The dependency chain is:
- SSO provides authentication and identity services.
- The Lookup Service provides service registration and discovery.
- The Web Client contacts the Lookup Service to locate the relevant vSphere services.
- The Web Client connects through vCenter Server to manage inventory and ESXi hosts.
| Component | Must be available before Web Client installation | Why it is required | Connectivity or identity requirement |
|---|---|---|---|
| vCenter Single Sign-On | Yes | Authenticates the installer and Web Client users. | SSO service must be running and reachable. |
| Lookup Service | Yes, as part of the SSO service deployment | Allows the Web Client to discover registered vSphere services. | Use the correct HTTPS endpoint and port. |
| vCenter Server | It should be installed and registered when the Web Client is validated. | Provides centralized inventory and management of ESXi hosts. | The Web Client must be able to reach the intended vCenter environment. |
| ESXi hosts | Not required to install the Web Client | They are managed through vCenter after the installation. | They must be connected to vCenter for inventory validation. |
Start the VMware vCenter Server Installer
- Locate the vCenter Server installation media or the directory containing the extracted installation files.
- On the Windows Server selected for the Web Client, launch the VMware vCenter Server installer executable with an account authorized to install software and services.
- Select the vSphere Web Client component. Do not select another vCenter component unless it is part of a separately planned deployment.
The exact executable name and menu presentation can vary between vSphere releases, but the component selection must identify the Web Client rather than Simple Install or a different vCenter service.
Complete the Installation Workflow
1. Select language and review the welcome screen
Select the installer language, continue past the welcome screen, and verify that the selected component is the vSphere Web Client.
2. Accept the license agreement
Read and accept the license agreement to continue. If the acceptance option is unavailable, the installer will not proceed.
3. Select the target folder
Enter or browse to the installation directory planned for this Windows Server. Use a local path with sufficient space and permissions. Avoid changing the location to a temporary or removable volume.
4. Configure Web Client connection and port settings
Enter the local connection settings requested by the installer. These settings define how the Web Client service listens and communicates. Check each proposed port against the services already running on the server.
| Installer field | Purpose | Example or format | Validation guidance |
|---|---|---|---|
| Installation folder | Determines where Web Client files are stored. | C:\Program Files\VMware\Infrastructure\ or an approved alternative. | Confirm free space, permissions, and organizational standards. |
| Web Client service ports | Defines local service listeners and related communication endpoints. | Port values supplied by the installer. | Verify that each selected port is unused and allowed by firewalls. |
| SSO administrator | Authenticates the installation to the vSphere SSO domain. | <administrator>@vsphere.local | Use the account created during SSO deployment and its current password. |
| Lookup Service URL | Identifies the SSO service-discovery endpoint. | https://sso.example.local:7444/lookupservice/sdk | Confirm DNS, routing, port access, path, and certificate identity. |
If a selected port is already used by a web server, monitoring tool, VMware component, or other application, identify the conflict before continuing. Stop or reconfigure the conflicting service, choose an approved unused port, or install the Web Client on another host.
5. Enter SSO credentials
Provide the SSO administrator identity and password. The account is an identity in the internal SSO domain, not necessarily a Windows local administrator account. The Windows account installs the software; the SSO account authenticates the Web Client to the SSO environment.
6. Construct and enter the Lookup Service SDK URL
Use this endpoint structure:
https://<SSO-host-FQDN-or-IP>:7444/lookupservice/sdkFor example, if the SSO server is named sso.example.local:
https://sso.example.local:7444/lookupservice/sdkPort 7444 is the default SSO HTTPS port for this deployment generation. Confirm the actual value in the environment and installer documentation if it has been changed. Prefer an FQDN when DNS and certificates are configured for that name. The host portion must identify a reachable SSO system and should match the identity represented by the service certificate.
7. Verify the SSL certificate fingerprint
Before trusting the Lookup Service, the installer displays an SSL certificate fingerprint. A fingerprint is a compact identifier derived from a certificate. It helps confirm that the connection is reaching the intended SSO service rather than the wrong host or an unexpected intermediary.
- Record the fingerprint shown by the installer.
- Compare it with an authoritative value obtained from the SSO server, trusted certificate records, or the organization's certificate-management process.
- Inspect the certificate subject, issuer, validity period, and host identity when those details are displayed.
- Do not approve the certificate if the fingerprint or identity is unexpected. Correct DNS, routing, certificate, or endpoint configuration first.
- When the identity is verified, approve the certificate and install trusted certificates when the installer prompts for that action.
Installing the trusted certificate enables secure communication between the Web Client and the SSO Lookup Service. It does not remove the need to verify the certificate before accepting it.
8. Review and begin installation
Review the final summary carefully. Confirm the target folder, local ports, SSO administrator identity, Lookup Service URL, and certificate decision. Start the installation only after the values match the planned architecture.
Post-Installation Validation
| Check | Expected result | How to verify | Likely issue if it fails |
|---|---|---|---|
| Windows services | Web Client services are installed and running. | Use Windows service management tools and review service startup status. | Installation error, dependency failure, account problem, or port conflict. |
| Web Client URL | The login page opens from a supported browser. | Browse to the deployed Web Client host and configured endpoint. | Wrong URL or port, stopped service, firewall block, or browser incompatibility. |
| SSO login | An SSO identity can authenticate successfully. | Sign in with a permitted SSO account. | Incorrect credentials, unavailable SSO, certificate trust problem, or time/name mismatch. |
| vCenter inventory | The expected vCenter inventory is visible. | Inspect vCenter objects after login. | vCenter unavailable, registration problem, wrong SSO environment, or missing permissions. |
| ESXi management | Connected ESXi hosts can be viewed and managed according to permissions. | Open the host or cluster inventory and perform an authorized read or management operation. | Host connection issue, vCenter health issue, or insufficient role permissions. |
| Operations documentation | Deployment details are recorded. | Record the URL, ports, service accounts, SSO domain, and certificate information. | Future troubleshooting and certificate renewal become more difficult. |
Troubleshooting
Lookup Service connection failure
If the installer cannot connect to the Lookup Service, recheck the HTTPS scheme, SSO host name, port, and /lookupservice/sdk path. From the Web Client server, verify DNS resolution and HTTPS reachability. Confirm that SSO and Lookup Service processes are running and that firewalls permit the connection.
Unexpected certificate or fingerprint mismatch
Do not accept an unexpected certificate. The connection may be reaching the wrong host, DNS may map the name incorrectly, the certificate may have been replaced, or an untrusted intermediary may be present. Compare the displayed fingerprint with an authoritative record, then correct the endpoint, DNS, or certificate configuration.
Required port is already in use
Identify the listening process and determine whether it is another VMware component, a web service, or an unrelated application. Remove the conflict, assign a permitted alternate port, or use another host. Update firewall rules and operational documentation if a non-default port is selected.
Installation completes but the Web Client does not open
Check that the Web Client services are running, confirm the URL and configured port, and test inbound firewall access. Review installation and service logs. Because this is a legacy interface, also verify that the browser is supported by the deployed vSphere version.
Login succeeds but inventory is missing
Verify vCenter Server health and service registration. Confirm that the Web Client is connected to the intended SSO environment and that the signed-in user or group has permissions on the vCenter inventory. Successful SSO authentication alone does not grant vCenter object permissions.
Companion Client Components
The legacy desktop vSphere Client is different from the browser-based vSphere Web Client. The desktop client is installed separately and has its own version and compatibility requirements.
The VMware Client Integration Plug-in is an optional legacy browser integration component used by applicable workflows. It may support client-side operations that the browser alone cannot perform in certain older environments. Install it only when the vSphere release and workflow require it, and follow its separate installation procedure and compatibility requirements.
Exam-Relevant Notes
- Simple Install places SSO, Inventory Service, vCenter Server, and Web Client together on one Windows system.
- Custom Install allows those components to be distributed across separate machines.
- The Web Client connects to vCenter Server; it is not a direct replacement for the individual ESXi host interface.
- The SSO Lookup Service URL uses HTTPS, the SSO host, the deployment-generation default port
7444, and the path/lookupservice/sdk. - Verify the SSL certificate fingerprint before accepting and trusting the Lookup Service certificate.
- Successful Web Client installation requires more than a running service: validate browser access, SSO login, vCenter inventory, and ESXi host management.
Deployment Checklist
- Select a supported Windows Server for the standalone Web Client.
- Confirm FQDN resolution and network access between the Web Client server and SSO.
- Verify that SSO and the Lookup Service are operational.
- Choose an installation directory and check available ports.
- Launch the vCenter Server installer and select vSphere Web Client.
- Enter the Web Client settings, SSO administrator credentials, and Lookup Service SDK URL.
- Validate the presented certificate fingerprint and install trusted certificates when prompted.
- Review the summary and complete the installation.
- Verify services, browser access, SSO login, vCenter inventory, and ESXi management.
- Document the URL, ports, service accounts, SSO domain, and certificate details.
For the complete procedure, use this vSphere Web Client installation guide.