AllCertificationsGeneral ITNSXOMVStorage & BackupTrueNASVCFvRealizevSphereVVF Lab

RSTechHub

How to Deploy an Offline Depot for VCF 9.0 and 9.1

How to Deploy an Offline Depot for VCF 9.0 and 9.1

If your VCF environment sits behind a firewall with no outbound internet access, or you simply want deterministic control over what binaries reach your platform, you need an offline depot. I have built these for both VCF 9.0 and 9.1, and the process changed between versions in ways that will trip you up if you follow a 9.0 guide on a 9.1 deployment. This post covers both, end to end, from a bare Ubuntu VM to a working depot that SDDC Manager can pull from.

Why Build an Offline Depot

The VCF Installer and SDDC Manager need access to a software depot to download installation binaries, upgrade bundles, and ESX patches. In connected mode, they pull directly from the Broadcom online depot. In air-gapped or restricted environments, you host your own depot on a local web server and point VCF at it.

There is also a practical reason beyond air-gapping. The online depot can be slow, and download failures mid-deployment are painful. Having a local depot with the binaries already staged removes that variable entirely. In my own lab builds, I run separate depot VMs for each VCF version specifically because the VCF Download Tool is version-bound and managing multiple ESX trains on one instance gets messy.

What Changed Between VCF 9.0 and 9.1

This is the single most important difference and the reason I am covering both versions in one post.

In VCF 9.0, you authenticate against the Broadcom depot using a download token generated from the Broadcom Support Portal. You paste that token into a file, pass it to the VCF Download Tool, and you are downloading binaries within minutes.

VCF 9.1 replaced this with a depot registration model. Each offline depot (or VCF Installer instance) now requires its own unique software depot ID and a corresponding activation code. You generate the depot ID using the VCF Download Tool, register that ID in the VCF Business Services Console, and receive an activation code in return. Download tokens still work for most component downloads in 9.1, but ESX patches specifically require the activation code. Broadcom made this change to prevent token sharing and to tie each depot to a specific registered instance.

If you follow a 9.0 guide when building for 9.1, the ESX downloads will fail. If you follow a 9.1 guide for 9.0, you will be looking for a Business Services Console registration page that does not exist yet for your version. Match the process to your target version.

VM Specifications

The depot VM does not need much compute, but it needs disk space. Here is what I use:

  • OS: Ubuntu 24.04 LTS (Ubuntu 22.04 LTS, RHEL/Rocky 9, and Photon OS 5 are also supported)
  • vCPU: 2
  • RAM: 4 GB
  • Disk: 60 GB for the OS, plus a separate 1 TB data disk for the depot files (a fresh VCF 9.0 install set is roughly 88 GB, and a full depot with multiple versions and native ESXi lifecycle bundles approaches 500 GB)
  • Network: Static IP on the management VLAN, reachable from SDDC Manager
  • DNS: An A record for the depot FQDN (recommended but not strictly required)

Step 1: Install and Configure the OS

Install Ubuntu 24.04 LTS with a standard server configuration. During installation, set a static IP, configure DNS, and create a non-root user with sudo access. After the first boot, update the system:

sudo apt update && sudo apt upgrade -y
sudo timedatectl set-timezone Europe/London
sudo apt install -y nginx openssl

Alternative: VMware Photon OS 5.0

If you prefer to standardize on the same OS that VCF appliances run, Photon OS 5.0 is a supported option. Boot from the Photon OS 5.0 ISO, accept the EULA, select Photon Full as the installation type to ensure all developer tools and networking libraries are included, set your hostname and root password, and reboot. Enable SSH root login if needed by editing /etc/ssh/sshd_config, setting PermitRootLogin yes, and restarting the service:

systemctl restart sshd

For Photon OS, replace apt commands with tdnf throughout the remaining steps.

Mount your data disk to a dedicated path. I use /depot:

sudo mkfs.ext4 /dev/sdb
sudo mkdir /depot
sudo mount /dev/sdb /depot
echo 'UUID='$(sudo blkid -s UUID -o value /dev/sdb)' /depot ext4 defaults 0 2' | sudo tee -a /etc/fstab

Step 2: Generate SSL Certificates

SDDC Manager requires HTTPS (TLSv1.2 or TLSv1.3) to connect to the depot. You can use a certificate from your internal CA, a self-signed certificate, or Let’s Encrypt if the depot has a public FQDN. For a lab or internal deployment, a self-signed certificate works fine:

sudo mkdir -p /etc/nginx/ssl
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout /etc/nginx/ssl/depot.key \
  -out /etc/nginx/ssl/depot.crt \
  -subj "/C=GB/ST=London/L=London/O=RSTechHub/CN=depot.yourdomain.com"

Replace the subject fields with your own organization details. The CN must match the FQDN you will use to connect from SDDC Manager. If you use a self-signed certificate, you will need to import the CA certificate into the VCF Installer’s trust store later, which I cover in the connection step.

Step 3: Configure Nginx with HTTPS and Basic Auth

SDDC Manager expects basic authentication on the depot. An anonymous depot will be rejected. Create the htpasswd file first:

sudo apt install -y apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd vcfdepot

Enter a password when prompted. Then create the Nginx virtual host configuration:

sudo tee /etc/nginx/sites-available/depot <<'EOF'
server {
    listen 443 ssl;
    server_name depot.yourdomain.com;

    ssl_certificate /etc/nginx/ssl/depot.crt;
    ssl_certificate_key /etc/nginx/ssl/depot.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    root /depot;
    autoindex on;

    auth_basic "VCF Depot";
    auth_basic_user_file /etc/nginx/.htpasswd;

    location / {
        try_files $uri $uri/ =404;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/depot /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

Create the required VCF product directory structure and set ownership:

sudo mkdir -p /depot/PROD/COMP/
sudo chown -R www-data:www-data /depot/

Test the connection from another machine by browsing to https://depot.yourdomain.com (accepting the self-signed certificate warning). You should see an empty directory listing after entering the basic auth credentials.

Alternative: Apache on Ubuntu or Photon OS

If you prefer Apache over Nginx, install the packages:

# Ubuntu
sudo apt install apache2 openssl apache2-utils -y

# Photon OS
tdnf update && tdnf install httpd openssl httpd-tools -y
systemctl enable --now httpd

Generate the SSL certificate (adjust paths for your OS):

sudo mkdir -p /etc/httpd/ssl
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/httpd/ssl/vcfdepot.key \
  -out /etc/httpd/ssl/vcfdepot.crt

Create the htpasswd file and directory structure:

sudo htpasswd -c /etc/httpd/.htpasswd vcfuser
sudo mkdir -p /depot/PROD/COMP/

# Set ownership for Ubuntu
sudo chown -R www-data:www-data /depot/
# Or for Photon OS
sudo chown -R httpd:httpd /depot/

Create the virtual host at /etc/apache2/sites-available/vcf-depot.conf (Ubuntu) or /etc/httpd/conf.d/vcf-depot.conf (Photon OS):

<VirtualHost *:443>
    DocumentRoot /depot
    SSLEngine on
    SSLCertificateFile /etc/httpd/ssl/vcfdepot.crt
    SSLCertificateKeyFile /etc/httpd/ssl/vcfdepot.key
    ErrorLog /var/log/httpd-error.log

    <Directory "/depot">
        Options Indexes FollowSymLinks
        AllowOverride None
        AuthType Basic
        AuthName "VCF 9 Offline Repository"
        AuthUserFile /etc/httpd/.htpasswd
        Require valid-user
    </Directory>
</VirtualHost>

Activate and restart:

# Ubuntu
sudo a2ensite vcf-depot.conf && sudo a2enmod ssl auth_basic && sudo systemctl restart apache2

# Photon OS
systemctl restart httpd

Warning: Windows IIS MIME Types

While this guide covers Linux web servers, some administrators attempt to host the depot on Windows IIS. If you do, SDDC Manager will fail immediately with 403 or 404 errors when trying to fetch component signatures. IIS blocks .sig, .ova, and .ovf file extensions by default. To fix this, you must manually add these extensions to the IIS MIME Types configuration, mapping them as application/octet-stream. This is a known issue tracked in Broadcom KB 408994. The simpler path is to use Linux with Nginx or Apache, which serve these file types without additional configuration.

Step 4: Install the VCF Download Tool

Download the VCF Download Tool (VCFDT) from the Broadcom Support Portal. The tool is version-specific, so download the version that matches your target VCF release (9.0.x or 9.1.x). Upload the tarball to the depot VM and extract it:

mkdir ~/vcfdt
tar -xvf vcf-download-tool-*.tar.gz -C ~/vcfdt
cd ~/vcfdt/bin

The VCFDT package also includes the UMDS (Update Manager Download Service) installation files for downloading ESX patches.

Step 5: Authenticate and Download Binaries

This is where VCF 9.0 and 9.1 diverge. Follow the section that matches your target version.

VCF 9.0: Download Token

Log into the Broadcom Support Portal and generate a download token. Save it to a file on the depot VM:

echo "your-broadcom-download-token" > ~/download-token.txt

Create the depot directory structure and download the installation binaries:

mkdir -p /depot/PROD
./vcf-download-tool binaries download \
  --depot-download-token-file=$HOME/download-token.txt \
  --depot-store=/depot \
  --vcf-version=9.0.0.0 \
  --type=INSTALL

This downloads all 15 installation packages (roughly 88 GB). For upgrade bundles, change --type=INSTALL to --type=UPGRADE. You can also download individual components by adding --component=VCENTER or --component=NSX_T_MANAGER to target specific packages.

VCF 9.1: Activation Code

VCF 9.1 requires a registered software depot ID. Generate it using the download tool:

./vcf-download-tool configuration generate --software-depot-id

This prints a unique depot ID. Copy it, then log into the VCF Business Services Console at https://vcf.broadcom.com. Navigate to Software Depot Registrations, click Register Software Depot, paste your depot ID, give it a friendly name, and click Register. The console returns an activation code. Save it:

echo "your-activation-code" > ~/activation-code.txt

Now download the installation binaries using the activation code:

mkdir -p /depot/PROD
./vcf-download-tool binaries download \
  --depot-download-activation-code-file=$HOME/activation-code.txt \
  --depot-store=/depot \
  --vcf-version=9.1.0.0 \
  --sku=VCF \
  --type=INSTALL

VCF 9.1 has 23 components (compared to 15 in 9.0), including new ones like VCF_OBSERVABILITY_DATA_PLATFORM, VCF_SALT, and VIDB. The download is larger and takes longer.

For ESX patches in 9.1, UMDS is deprecated. Use the new esx namespace to sync patches directly. The activation code is required:

./vcf-download-tool esx download \
  --depot-download-activation-code-file=$HOME/activation-code.txt \
  --depot-store=/depot

Before downloading ESX patches, filter out old ESX trains you do not need:

./vcf-download-tool esx configuration -D=embeddedEsx-6.7-INTL
./vcf-download-tool esx configuration -D=embeddedEsx-7.0-INTL
./vcf-download-tool esx configuration -D=embeddedEsx-8.0-INTL
./vcf-download-tool esx configuration -D=esxio-8.0-INTL
./vcf-download-tool esx configuration -D=esxio-9.0-INTL
./vcf-download-tool esx configuration -G

Alternative: The Two-Step Sneakernet Air-Gap Workflow

If your depot VM has absolutely no internet access, run the download on a separate internet-connected workstation first, then transfer the files physically.

On the connected machine, run the same download commands but point --depot-store to a local staging directory. Once complete, copy the entire structure to removable media. On the air-gapped depot VM, copy the PROD/ directory into your web server document root. The structure must be preserved exactly as the VCF Download Tool created it.

# On the internet-connected workstation
./vcf-download-tool binaries download \
  --depot-download-activation-code-file=./activation-code.txt \
  --depot-store=/mnt/usb/vcf-depot \
  --vcf-version=9.1.0.0 \
  --sku=VCF --type=INSTALL

# Transfer USB to the air-gapped depot VM, then:
sudo cp -a /mnt/usb/vcf-depot/* /depot/

Step 6: Verify the Depot Structure

After the download completes, verify that the depot has the correct directory structure. The VCF Installer expects a PROD/ directory as an immediate child of the document root. Copying individual bundle files into a folder without the proper structure will not work because VCF reads the metadata alongside the binaries.

ls /depot/PROD/

You should see subdirectories for each component plus metadata files. For 9.1, you will also see UUID-namespaced vmw/ subdirectories for vCenter delivery and additional metadata paths under PROD/metadata/.

Step 7: Connect to the Offline Depot

Establish Security Trust Chains

If you used a self-signed certificate, extract it from the depot server:

echo | openssl s_client -connect depot.yourdomain.com:443 2>/dev/null | \
  openssl x509 -out depot-cert.pem

Copy the certificate to the VCF Installer appliance and import it into the Java 21 trust store:

scp depot-cert.pem root@vcf-installer:/tmp/

ssh root@vcf-installer

# VCF 9.x uses OpenJDK 21 - import into the exact runtime path
sudo keytool -importcert -trustcacerts -alias vcf-depot \
  -file /tmp/depot-cert.pem \
  -keystore /usr/lib/jvm/openjdk-java21-headless.x86_64/lib/security/cacerts \
  -storepass changeit -noprompt

On the SDDC Manager appliance, drop the .pem file directly into the trusted certificates directory where the OS automatically picks it up:

scp depot-cert.pem root@sddc-manager:/etc/vmware/vcf/commonsvcs/trusted_certificates/
ssh root@sddc-manager
systemctl restart lcm operationsmanager

For production environments, use your enterprise CA to issue a certificate with the depot FQDN as the Subject Alternative Name. If your VCF components already trust the CA, no manual imports are needed.

Target Interface Mapping

VCF 9.0 / VCF Installer (Greenfield): Open the VCF Installer dashboard, navigate to the Download Binary section, switch from Online Depot to Offline Depot, enter the depot URL, provide the basic auth credentials, and click Configure.

VCF 9.1 (Fleet Depot Service): Individual SDDC Manager repository settings are deprecated. Configure the software depot globally within VCF Operations under Build, then Software Depot. Once saved, the entire fleet automatically inherits the depot configuration via the central Fleet Depot Service.

VCF 9.1: HTTP Depot Without Authentication

VCF 9.1 introduced official support for an HTTP-only, unauthenticated offline depot. This lets you skip the entire SSL certificate and basic auth configuration if your network security model allows unencrypted traffic between SDDC Manager and the depot.

There is a catch. The VCF 9.1 Installer UI does not accept an HTTP address and will throw a validation error if you try. To use this option, you need to deploy via the VCF Installer API instead of the UI. Passing the HTTP URL payload directly through the API skips UI validation and configures the Fleet Depot Service to use unencrypted traffic. This is a lab-friendly shortcut, not a production recommendation. William Lam covers this capability in detail on his blog.

Step 8: Day-2 Maintenance and Automation

Automating Depot Syncs

Once the depot is built and connected, keep it current with a cron job rather than manually running the download tool after every Broadcom patch release:

#!/bin/bash
# /opt/vcfdt/sync-depot.sh
LOG="/var/log/vcf-depot-sync.log"
echo "$(date) - Starting depot sync" >> $LOG
cd /opt/vcfdt/bin
./vcf-download-tool binaries download \
  --depot-download-activation-code-file=/root/activation-code.txt \
  --depot-store=/depot --vcf-version=9.1.0.0 \
  --sku=VCF --type=UPGRADE >> $LOG 2>&1
./vcf-download-tool esx download \
  --depot-download-activation-code-file=/root/activation-code.txt \
  --depot-store=/depot >> $LOG 2>&1
echo "$(date) - Sync complete" >> $LOG
chmod +x /opt/vcfdt/sync-depot.sh
# Run every Sunday at 02:00
(crontab -l; echo "0 2 * * 0 /opt/vcfdt/sync-depot.sh") | crontab -

Managing Storage and Cumulative Growth

The VCF Download Tool is cumulative. It adds new packages without removing old ones, so your depot grows with every sync. A full depot spanning 9.0 through 9.1 plus ESX patches can exceed 500 GB. Monitor disk usage regularly:

du -sh /depot/PROD/
df -h /depot

If you no longer need older VCF versions, reclaim space by removing their component directories from /depot/PROD/COMP/. Only remove versions you are certain no SDDC Manager instance will request. Keep the download token (9.0) or activation code (9.1) files secured and never commit them to source control.

Troubleshooting

These are the three issues I see most often when connecting SDDC Manager to an offline depot.

Secure protocol communication error: VCF rejects unencrypted HTTP connections on port 80. Make sure your web server is listening on port 443 with TLS enabled. In a lab environment where you need to temporarily bypass this, you can set LCM_DEPOT_ADAPTER_HTTPS_ENABLED = false in application-prod.properties on SDDC Manager and restart the LCM service, but never do this in production.

Download fails immediately from VCF Installer: This usually means the VCF Download Tool did not populate the full directory structure. The PROD/ directory must contain the component subdirectories and the metadata catalog files. Re-run the VCFDT with the correct --type and --vcf-version flags to sync the full manifest.

HTTP 403 Forbidden on Apache: Apache cannot read the depot files because the filesystem ownership does not match the web server user. Fix this with sudo chown -R www-data:www-data /depot/ && sudo chmod -R 755 /depot/ on Ubuntu or sudo chown -R httpd:httpd /depot/ && sudo chmod -R 755 /depot/ on Photon OS.

Essential Log File Paths

When debugging depot connectivity, check these logs first:

Component Log Path
VCF Download Tool Pipe output with >> sync.log 2>&1
Nginx /var/log/nginx/error.log
Apache /var/log/apache2/error.log (Ubuntu) or /var/log/httpd-error.log (Photon)
SDDC Manager LCM /var/log/vmware/vcf/lcm/lcm.log
VCF Installer /var/log/vmware/vcf/bringup/bringup.log
VCF Operations /var/log/vmware/vcf/operationsmanager/operationsmanager.log

The Bottom Line

An offline depot is a straightforward build: Ubuntu or Photon OS VM, Nginx or Apache with HTTPS and basic auth, the VCF Download Tool, and the right authentication method for your version. The trap is using a 9.0 download token workflow on a 9.1 deployment, or the reverse. Match the authentication model to the version, verify the PROD/ directory structure before connecting SDDC Manager, and keep your depot VM sized for growth if you plan to host multiple releases.