Month: February 2024

Short answer: download the VMware Visio stencils from github.com/h0bbel/vmware-stencils (Code → Download ZIP). It is the VMware Validated Design (VVD) icon set: vmw_Icons.vssx, vmw_colors.vssx, the vmw_template.vstm template and 111 SVG icons, and it still opens in current Visio and draw.io. Broadcom has not published a newer set for VCF 9, so this page also shows which icon to use for each VCF 9 component.

Download the VMware Visio stencils (VVD icon set)

Old links point to VMTN community documents and to github.com/tenthirtyam/vmware-stencils. Both are dead; the GitHub repository returns 404. These are the working options, checked in October 2026:

Source	What you get	Access	Status
h0bbel/vmware-stencils on GitHub	Visio .vssx stencils and .vstm template, OmniGraffle stencils, PPTX, 111 SVG icons	Public, no login: Code → Download ZIP	Content last changed 2020-11-30, no license file
draw.io (diagrams.net) built-in library	“VMware” shape library (More Shapes → Networking), same VVD icon family	Free, web or desktop app	Maintained as part of draw.io
Broadcom TechDocs	Official architecture diagrams inside the VCF documentation	Public	Reference only, not a stencil pack

The GitHub fork chain is Ryan Johnson (tenthirtyam, deleted) → foozy74/vmware-stencils → h0bbel/vmware-stencils (Christian Mohn). Direct ZIP: https://github.com/h0bbel/vmware-stencils/archive/refs/heads/main.zip.

What is in the VMware stencils package

Folder	Files	Use
visio/	vmw_Icons.vssx, vmw_colors.vssx, vmw_template.vstm	Icons, “Colors and Boxes” stencil, Visio template
omnigraffle/	vmw_icons.gstencil, vmw_color.gstencil, vmw.clr	OmniGraffle on macOS plus the color palette
pptx/	vmw_icons.pptx (about 19 MB)	Icons for slide decks
svg/	111 individual SVG icons	draw.io, web pages, any vector editor

The icon stencil is named vmw_Icons.vssx with a capital I, while the README writes vmw_icons.vssx. On Windows this does not matter; in scripts on Linux or macOS it does. The CHANGELOG has four releases: 2018-08-14 (initial), 2019-05-31 (large icon update and example diagrams), 2019-10-03 (fixed SDDC stencil and template) and 2020-11-20 (Visio update, plus OmniGraffle, PowerPoint and SVG). Nothing has been added since.

How to install VMware stencils in Visio

1. Download the ZIP and extract it.
2. Copy vmw_template.vstm, vmw_Icons.vssx and vmw_colors.vssx to C:\Users\<username>\Documents\My Shapes. Visio uses this folder as the default location for custom stencils.
3. Open vmw_template.vstm to start a drawing with the intended page setup.
4. In the Shapes pane, choose More Shapes → Open Stencil, select both .vssx files and click Open. Stencils saved in My Shapes are also listed under More Shapes → My Shapes.
5. Save the drawing. Stencils open in the Shapes window stay attached to that drawing the next time you open it.

The README also lists the house style from VMware documentation: Metropolis font, no text smaller than 11 pt, do not scale icons and shapes, and keep the template’s paper format.

VMware stencils for draw.io (diagrams.net) and OmniGraffle

• draw.io built-in library: open More Shapes, go to Networking and enable VMware. It is the VMware Validated Design (VVD) icon family; the shapes are tagged “vmware validated design”, so the shape search finds them too. No download needed.
• draw.io with the GitHub files: drag vmw_Icons.vssx and vmw_colors.vssx into the web or desktop app (the README documents this), or drag individual SVGs from the svg/ folder onto the canvas.
• OmniGraffle (macOS): create a VMware folder in ~/Library/Containers/com.omnigroup.OmniGraffle7/Data/Library/Application Support/The Omni Group/OmniGraffle/Stencils, copy both .gstencil files there, and copy vmw.clr to ~/Library/Colors.

Other VMware stencil sets compared

Search results for VMware stencils mix this set with older and vendor-specific packs. This is what each one is good for:

Set	Covers	Last updated	Format	Use it for
VVD icons (h0bbel/vmware-stencils)	vCenter, ESXi, VM, vSAN, NSX (Manager, gateway, DLR, CSM), HCX, Site Recovery, Kubernetes, vRealize products, generic infrastructure	2020-11	.vssx, .vstm, .gstencil, .pptx, .svg	VMware design documents (HLD/LLD), VCF diagrams with relabeled boxes
draw.io “VMware” library	The same VVD icon family	Maintained with draw.io	Built in (More Shapes → Networking)	Wikis, labs, shared editing without distributing files
vmtoday.com stencils	vSphere icons, Horizon View (184 shapes), vCenter Orchestrator (118 shapes)	Drawn 2012–2014	.vssx, .vss	Horizon and Orchestrator diagrams; not VCF
Veeam stencils	250+ shapes: generic hosts, storage, VMs and Veeam components. The old veeam.com stencil URL now opens Veeam’s brand resource center; draw.io also has a built-in “Veeam” library under Networking.	Maintained by Veeam	Visio, draw.io built-in	Backup and data-protection designs
VeloCloud stencils (Broadcom KB 376248)	VMware VeloCloud SD-WAN only	Official Broadcom attachment	Visio ZIP	SD-WAN topologies

The VeloCloud pack is the only official Broadcom stencil download I could find. For vSphere, vSAN, NSX and VCF, the VVD set is still the most complete VMware-specific option.

Which package for which diagram

Diagram	Best fit	Why
Customer design document (HLD/LLD) in Visio	vmw_template.vstm + both .vssx	Same icons and box colors as the old VVD documentation
Lab or wiki diagram, shared editing	draw.io built-in VMware library	Free, no files to distribute
Slide deck	vmw_icons.pptx	Icons already sized for PowerPoint
Web page, Markdown docs, Excalidraw-style tools	svg/ folder	Plain vector files, easy to recolor
Mac users	OmniGraffle stencils	Native format and palette

Mapping VVD icons to VCF 9 components

The icon set is from the vSphere 7 and vRealize era, so several VCF 9 components have no icon of their own and the management products still carry vRealize names. The practical approach: use the closest VVD icon and put the current VCF 9 name in the label. File names below are from the svg/ folder; the Visio stencil uses the same icons.

VCF 9 component	VVD icon to use	Note
vCenter	vcenter-server.svg	Exact match
ESX host	rack-server.svg, or vm-server.svg for a host with VMs	Label as ESX 9.x
Virtual machine	vm.svg	Exact match
vSAN (OSA or ESA)	vmware-vsan.svg	Put “ESA” in the label; there is no separate ESA icon
vSphere Distributed Switch	virtual-switch.svg	Physical uplinks: physical-nic.svg, ToR: switch.svg
NSX Manager	nsx-manager.svg	Exact match
NSX Edge, Tier-0 / Tier-1 gateway	nsx-gateway.svg	Use router.svg for the physical BGP peers
NSX VPC	none	Use a box from vmw_colors.vssx labeled “VPC”
VCF Operations	vrops.svg	Relabel; the icon still says vRealize Operations
VCF Operations for logs	vmware-vrealize-log-insight.svg	Relabel
VCF Operations for networks	vmware-vrealize-network-insight.svg	Relabel
VCF Automation	vmware-vrealize-automation.svg	Relabel
SDDC Manager / VCF Operations fleet management	vmware-cloud-foundation.svg	No dedicated icon. Separate components in 9.0; Broadcom’s 9.1 feature comparison lists fleet management as “formerly SDDC Manager”
VCF Operations orchestrator	vmware-vrealize-orchestrator.svg	Relabel
VCF Installer	virtual-appliance.svg	No dedicated icon
vSphere Supervisor / vSphere Kubernetes Service	kubernetes.svg	pks.svg is the old Enterprise PKS icon; avoid it
VCF Operations HCX	vmware-hcx.svg	Same icon, new name
Site Recovery, vSphere Replication	vmware-site-recovery.svg, vmware-vsphere-replication.svg	Label with the current product name
VCF Identity Broker, external IdP	identity.svg	Generic
Certificate authority	certificate-server.svg	Generic
Avi Load Balancer	load-balancer.svg	Generic

For a VCF 9 design, start from the component list in VCF 9.0 minimum requirements for a lab to decide which boxes belong on the page, and check component names against Broadcom KB 401497 (the VCF 9.0 component list). Official reference diagrams are in the VCF documentation on TechDocs. A worked example is my VCF 9 lab network diagram.

Is there a VMware Visio stencils 2025 or 2026 update?

No. The “2025” and “2026” posts you find in search results point to the same 2020 files on GitHub. In a Broadcom Community thread about Visio stencils for VCF, a reply states that no current official VCF-specific Visio stencil package from Broadcom is known and that the old VVD packages are outdated for VCF 9.x. The README’s own note says official diagrams live in the product documentation, which today means Broadcom TechDocs. If Broadcom publishes a new set, it will be announced there or on the VCF blog. Until then, treat the VVD set as a community-maintained copy without a stated license: fine for internal design work, but check it against your policy before using it in commercial material.

Sources

• GitHub: h0bbel/vmware-stencils (file list, README install steps, CHANGELOG)
• draw.io source: Sidebar-VVD.js (built-in VMware Validated Design library) and Sidebar.js (More Shapes → Networking → VMware)
• Microsoft Support: Create, save, and share custom stencils and Import downloaded stencils
• Broadcom Community: Visio stencils for projects
• Broadcom KB 401497: VMware VCF 9.0 or VVF 9.0 downloads (component list)
• Broadcom KB 376248: VeloCloud stencils download
• Broadcom TechDocs: VMware Cloud Foundation 9.0 documentation
• vmtoday.com: VMware Visio stencils (vSphere, Horizon View, vCenter Orchestrator)
• Graham (virtualg.uk): Official VMware Visio Stencils & Icons – Update (the original post this page was based on)

Related on vdan.cz

• My VCF 9 lab network diagram
• Deploying a minimal VCF 9.0 lab
• VCF 9.0 minimum requirements for a lab
• NSX CLI commands: transport nodes, TEPs, VIBs and logs

Virtually Speaking: Inventory and Calculator scripts for VMware Cloud Foundation VCF and vSphere Foundation VVF

Virtually Speaking: Inventory and Calculator…

On this episode of the Virtually Speaking Podcast Pete and John welcome William Lam to discuss the details of some new tools for VMware Cloud Foundation VCF and VMware vSphere Foundation VVF.

---

VMware Social Media Advocacy

Quick Tip – Block or remove download URL for VMware Enhanced Authentication Plug-in (EAP)

Quick Tip – Block or remove download URL for…

There was a new VMware Security Advisory (VMSA-2024-0003) that was published this week that affects the deprecated VMware Enhanced Authentication Plug-in (EAP) and as part of the remediation, per VMware KB 96442, there are instructions on how to uninstall the EAP plugin from desktop systems […]

---

VMware Social Media Advocacy

Automate the deployment & initial configuration…

I love writing automation, especially for deploying a consistent and repeatable environment for testing or learning purposes. I recently deployed the latest Aria Suite Lifecycle Manager 8.14 (formally vRealize Suite Lifecycle Manager or vRSLCM) manually using the graphical Easy Installer method [..]

---

VMware Social Media Advocacy

Attention #vSphere8 customers in the U.S….

Take a look at the @VMware #vSphere 8 STIG Readiness Guide to get pertinent information about technical, standards-based hardening guidance:

---

VMware Social Media Advocacy

My vSphere Metrics book is out! Download now!

Thanks for all the feedback, the #vSphere Metrics book, 3rd edition, is finally released. The book remains free, and no, I don’t want your email address or your credit card number 😉 . Simply download from […]

---

VMware Social Media Advocacy

Short answer: /usr/lib/vmware-vmca/bin/certificate-manager on the vCenter Server Appliance is interactive only; there is no documented non-interactive or answer-file mode. To automate it you either script the underlying tools it wraps (certool, vecs-cli, dir-cli, service-control) following the documented manual CLI procedure, or you use Broadcom’s newer vCert utility, which Broadcom now recommends over certificate-manager for most certificate workflows. Always snapshot vCenter first.

What certificate-manager is and where it lives

The vSphere Certificate Manager is a menu-driven shell utility on the VCSA. According to Broadcom KB 318946 it must be run as root and offers eight options:

Option	Action
1	Replace Machine SSL certificate with Custom CA certificate
2	Replace VMCA root with Custom CA signing certificate and replace all certificates
3	Replace Machine SSL certificate with VMCA-generated certificate
4	Regenerate new default VMCA root and replace all certificates
5	Replace Solution User certificates with Custom CA certificates
6	Replace Solution User certificates with VMCA-generated certificates
7	Revert last operation by re-publishing old certificates
8	Reset all certificates

Useful paths for troubleshooting and automation:

• Binary: /usr/lib/vmware-vmca/bin/certificate-manager
• Log: /var/log/vmware/vmcad/certificate-manager.log
• Certificate template used by certool: /usr/lib/vmware-vmca/share/config/certool.cfg

Why it cannot be automated directly

Every option prompts for the SSO administrator password, certificate attributes and confirmations. Wrapping it with expect works in a lab but is brittle: prompts change between builds, and a mismatched answer can leave vCenter half-updated. certificate-manager is essentially a front end for the VMCA and VECS command-line tools, and it records the commands it runs in certificate-manager.log. Running a workflow once interactively in a lab and reading that log is a good way to see exactly which calls you need to reproduce.

Scripting solution user certificate replacement with certool, vecs-cli and dir-cli

Broadcom documents the manual CLI equivalent of option 6 in Replace Solution User Certificates with New VMCA-Signed Certificates. The solution users are machine, vpxd, vpxd-extension, vsphere-webclient and wcp. Because the steps are identical per user, they loop cleanly:

#!/bin/bash
# Run as root on the VCSA after taking a snapshot.
# sol_usr.cfg = certool config with your Country/Org/Hostname values.
CERTOOL=/usr/lib/vmware-vmca/bin/certool
VECS=/usr/lib/vmware-vmafd/bin/vecs-cli
DIRCLI=/usr/lib/vmware-vmafd/bin/dir-cli

for SU in machine vpxd vpxd-extension vsphere-webclient wcp; do
  $CERTOOL --genkey --privkey=$SU-key.priv --pubkey=$SU-key.pub
  $CERTOOL --gencert --cert=new-$SU.crt --privkey=$SU-key.priv --Name=$SU --config sol_usr.cfg
  $VECS entry delete --store $SU --alias $SU
  $VECS entry create --store $SU --alias $SU --cert new-$SU.crt --key $SU-key.priv
done

# Map each solution user to its unique service ID in VMware Directory:
$DIRCLI service list
# then for each one, e.g.:
# $DIRCLI service update --name vpxd-<ID> --cert new-vpxd.crt

service-control --stop --all && service-control --start --all

Notes: vecs-cli entry delete asks for confirmation unless you answer it (-y); dir-cli prompts for SSO credentials unless you pass --login and --password. Keep the password out of shell history, for example by reading it from a protected file. Replacing solution user certificates is rarely required: VMware’s guidance has long been to leave them VMCA-signed and replace only the Machine SSL certificate.

certificate-manager vs vCert: which one to use

vCert (KB 385107) is a Python-based tool from Broadcom support for vCenter 7.0, 8.0 and 9.x. KB 313947 now presents vCert as the primary method for solution user replacement and lists certificate-manager as the deprecated method.

	certificate-manager	vCert
Shipped with VCSA	Yes	No, downloaded from the KB
Status/expiry checks	No	Yes, across VECS stores, trust anchors, STS
Expired certificate recovery	Limited	Designed for it
Command-line options	None	Yes, see ./vCert.py --help
Logs	/var/log/vmware/vmcad/certificate-manager.log	/var/log/vmware/vCert/vCert.log

My rule of thumb: use vCert for checks, reports and recovery; use the raw certool/vecs-cli/dir-cli sequence only when you need a fully scripted, repeatable change in a pipeline. Installation and menu walkthrough are in Installing and using the vCert tool. If vCenter already shows “no healthy upstream” because the STS signing certificate expired, start with this STS certificate guide.

Before you run anything

1. Take a snapshot of vCenter; for Enhanced Linked Mode, take powered-off snapshots of all linked vCenters at the same time (KB 318946).
2. Confirm the hostname matches the FQDN in the certificate config, otherwise replacement does not complete correctly.
3. Expect connected products (NSX, backup, SRM, VCF Operations) to need re-registration or trust updates.

Further reading

• William Lam: Automating certificate-manager CLI operations in vCenter Server (VCSA)
• KB 318946: Using vSphere Certificate Manager to replace SSL certificates
• KB 385107: vCert, scripted vCenter expired certificate replacement
• KB 313947: Replace vCenter Solution User certificates with VMCA-issued certificates

Creating a custom VIB for ESXi 8.x

Back in 2012, a VMware Fling was released called VIB Author, which allowed users to create their own custom vSphere Infrastructure Bundles (VIB) that typically would include configuration changes that was not possible when using the vSphere API such as enabling custom ESXi firewall ports or […]

---

VMware Social Media Advocacy

Preserving VM snapshot hierarchy across vCenter…

On occasion, you might find yourself needing to take multi-level VM snapshots for various testing or development purposes, not an uncommon task for IT administrators. In the past, if you needed to move the VM and preserve its snapshot hierarchy, it was usually difficult and involved manual tasks […]

---

VMware Social Media Advocacy