vCenter 7.03 upgrade to 8. failed because of unsupported sha1 certificates on the ESXi host

Products

• VMware vCenter Server

Issue/Introduction

Getting error at Pre-checks for vCenter upgrade at start of stage 2

 

 

Environment

vCenter 7.03

Cause

Support for certificates with weak signature algorithms has been removed in vCenter Server 8.0. The certificate with subject  ID Root CA' in VECS store TRUSTED_ROOTS has weak signature algorithm sha1WithRSAEncryption

 

Resolution

1. Check vpxd.certmgmt.mode on the vCenter and confirm the mode is vmca
2. Disable HA for cluster before proceeding (in case HA task is stuck, disconnect the host and proceed with the following)
3. Renew the certificate for the host (configure tab, certificate)
4. Connect the hosts again 
5. Next run python certificate check to confirm the unsupported certificates are gone

 

Upgrading vCenter Server or ESXi 8.0 fails during precheck due to a weak certificate signature algorithm

• python vsphere8_upgrade_certificate_checks

 

Start the upgrade