Cluster Hardening, Certificates, and Trusted/Secure Boot
Hardening baseline
Change factory default credentials immediately, enforce length/complexity/lockout through Prism Central security settings, and limit Prism UI/API access to a management network. Close unused services, remove stale images and dormant VMs, track who holds Super Admin, and keep AOS, AHV, and Prism Central current via LCM (life cycle management). Follow the published security configuration guide and STIG/CIS guidance as a checklist, not as a one-time event.
Certificates
Prism Element and Prism Central present SSL certificates; replace self-signed certificates with CA-signed ones. Generate a CSR whose SANs cover every FQDN and IP used to reach the UI and API, and install the intermediate chain - a missing intermediate produces a "valid but untrusted" error that questions exploit. Certificates expire: monitor expiry and rotate ahead of it, then restart the relevant services and reload the browser session. Correct NTP and DNS are prerequisites; clock skew breaks both certificate validation and SAML.
Boot integrity
Secure Boot for AHV VMs is a per-VM UEFI setting. The guest OS must ship signed bootloaders - mainstream Windows and Linux images usually qualify, unsigned or custom images will not boot. Platform-level trusted/measured boot with TPM depends on validated hardware, so verify the support matrix before promising it. Enabling Secure Boot on an existing VM typically needs a power cycle, and a BIOS-to-UEFI conversion is not free.
Trap
Secure Boot protects the integrity of the boot chain - it does not encrypt data or replace access control.