Actually you're right but on the other side - that's what I'd done, I didn't realize there was actually a link on the vSphere site that lets you download a bunch of root certificates, so I hadn't done the obvious bit 🙂 Fixed now - the power of "find the solution as soon as you post to Slack" strikes again