Implement 'Refresh CA Certificates' by following the relevant step in Renew or Refresh ESXi Certificates.
If this does not resolve the issue, follow the steps to publish the custom CA certificate chain to vCenter TRUSTED_ROOTS and retry the above.
If publishing the certificate chain does not work, append the custom CA certificate chain text (in pem format) to /etc/vmware/ssl/castore.pem on the ESXi host(s), and restart hostd (/etc/init.d/hostd restart) and vpxa (/etc/init.d/vpxa restart). See ESXi Host Disconnected from vCenter and hostd Fails to Start After SSL Certificate Replacement for full details and steps.