To resolve the issue, follow below steps:
- Open Command Prompt as Administrator.
- vCenter Server installed on Windows : cd C:\Program Files\VMware\vCenter Server\vmafdd
- vCenter Server Appliance: cd /usr/lib/vmware-vmafd/bin/
- Export Trusted Root CRLS to a text file:
- vCenter Server installed on Windows :
vecs-cli.exe entry list --store TRUSTED_ROOT_CRLS | findstr Alias > C:\trusted_root_crl.txt
- vCenter Server Appliance:
./vecs-cli entry list --store TRUSTED_ROOT_CRLS |grep Alias > /tmp/trusted_root_crl.txt
- Open the trusted_root_crl.txt and Replace "Alias" with "vecs-cli entry delete --store TRUSTED_ROOT_CRLS -y --alias"
- Delete all the Alias in this CRLS store using the command:
- vCenter Server installed on Windows :
vecs-cli.exe entry delete --store TRUSTED_ROOT_CRLS --Alias <Certificate_Alias> -y (Here Certificate_Alias is the Alias of each certificate returned by above list command)
- vCenter Server Appliance:
./vecs-cli entry delete --store TRUSTED_ROOT_CRLS --Alias <Certificate_Alias> -y
Note: Certificate_Alias is the alias of each certificate returned by the above list command.
Example: ./vecs-cli entry delete --store TRUSTED_ROOT_CRLS -y --alias 76ddcc9450d3ccd5dd475df4e12708bf38c8875c
- ​Restart VapiEndpoint Service on vCenter server
service-control --stop vapiEndpoint
service-control --start vapiEndpoint
You can also run the scripts attached under the attachments section in this article for;
- Windows: remove_clrs
- Appliance: clr-fix
Note: If there are expired Certificates within the BACKUP_STORES please refer to
Clearing BACKUP_STORES certificates in the VCSA via shell script.(82560)