ESXCLI 9.1.0 GA: Simplified Installation, Modern Python Support, and Enhanced Security

For vSphere administrators and automation engineers, ESXCLI is one of the most fundamental utilities in the VMware management toolkit. It enables you to execute host management commands remotely against an ESXi host or target any host managed by vCenter Server—all from your local workstation or administrative jumpbox without requiring an interactive SSH session to the host.

We are excited to announce the general availability of standalone ESXCLI 9.1.0 (Build 25692154). This release brings streamlined installation via Python packaging, platform modernization, strict security hardening for host verification, fine-grained client logging control, and critical authentication stability fixes.

Whether you run administration tasks on Linux, macOS, or Windows, ESXCLI 9.1.0 makes remote management more secure, accessible, and reliable.

What’s New in ESXCLI 9.1.0

1. Modern Python Requirements & Simplified PyPI Distribution

ESXCLI 9.1.0 is distributed as a single PyPI-compatible Python package. You can now install and update standalone on Linux, Windows, and macOS using standard Python package management tools.

System Requirements

• Python Version: Requires Python 3.10 or later.
• Legacy Deprecation: Python 2.7 and Python versions earlier than 3.10 are no longer supported.

To install ESXCLI 9.1 via PyPI, run:

pip install vmware-esxcli

(Note: You can also download the standalone package directly from the Broadcom Developer Portal).

2. Strict Security Hardening: SHA-1 Deprecation

Security standard requirements continue to evolve across enterprise infrastructure. In ESXCLI 9.1.0, SHA-1 server certificate thumbprints are officially no longer accepted.

Breaking Change Notice

Only SHA-256 and SHA-512 thumbprints are supported when establishing verified remote sessions using:

• The –thumbprint command-line parameter
• The VI_THUMBPRINT environment variable
• Stored entries in the ESXCLI credential store

Important Action Required Before Upgrading:
Audit your automated scripts, CI/CD pipelines, environment variables, and credential store configurations. SHA-1 thumbprints must be replaced with SHA-256 or SHA-512 thumbprints prior to upgrading. Connections relying on SHA-1 thumbprints will fail in new 9.1.0 version.

Example: Running ESXCLI with a SHA-256 Thumbprint

---

3. Flexible Client Logging Control

In previous versions, ESXCLI automatically created and maintained a rotating .log file adjacent to the executable binary. In 9.1.0 version, log behaviour is fully configurable and silent by default:

• Default Behavior: The client no longer automatically creates or writes to a log file on disk.
• Custom Log Path (–log-file): Redirect client log messages to a file of your choice.
• Verbose/Debug Logging (–log-verbose): Enable debug-level verbosity to inspect protocol details and troubleshoot connectivity or command execution issues.

Example: Custom Verbose Logging

Upgrade Checklist for Administrators

Before you upgrade to latest 9.1 version, keep this quick checklist in mind:

1. Verify Python Environment: Ensure your administrative workstations are running Python 3.10+.
2. Update Thumbprints: Replace all SHA-1 thumbprints in scripts and saved credential stores with SHA-256 or SHA-512 thumbprints.
3. Review Logging Scripts: If any custom workflows rely on reading the default log file previously created next to the ESXCLI binary, update those scripts to explicitly pass –log-file <path>.

Downloads & Documentation

Get started today:

• Broadcom Developer Portal Download: Download ESXCLI 9.1.0
• PyPI Distribution: pip install vmware-esxcli
• Official Release Notes: ESXCLI 9.1.0 Release Notes