vCenter 7.03 upgrade to 8.x fails due to unsupported sha1 certificates on an ESXi host

Products

• VMware vCenter Server

Issue/Introduction

Pre-check error in vCenter upgrade at start of stage 2:

"The certificate with subject  ID 'Root CA' in VECS store TRUSTED_ROOTS has weak signature algorithm sha1WithRSAEncryption."

Environment

vCenter Server 7.03

vCenter Server 8.x

Cause

Support for certificates with weak signature algorithms has been removed in vCenter Server 8.x.

Resolution

1. Check vpxd.certmgmt.mode on the vCenter and confirm the mode is vmca.
   
   
2. Disable HA for cluster before proceeding (in case HA task is stuck, disconnect the host and proceed with the following):
   
   
   1. Renew the certificate for the host (configure tab, certificate).
      
      
   2. Re-connect the hosts.
      
      
3. Confirm the unsupported certificates are removed.
   
   
4. Proceed to Upgrade.
   
   
5. Replace certificates with Custom certificates if desired: Replacing the Default ESXi Certificate with a Custom Certificate