Unable to refresh/renew ESXi certificate from vCenter (for both VMCA and custom)
book
Article ID: 377969
calendar_today
Updated On:
Products
VMware vCenter Server 7.0VMware vCenter Server 8.0VMware vSphere ESXi 7.0VMware vSphere ESXi 8.0
Issue/Introduction
Symptoms:
ESXi certificate expired status on vCenter GUI, Expired certificate are showing in gui after vcenter patch/upgrade.
Right-click ESXi Host in Inventory > Certificates > Renew/Refresh Certificate not working, renew/refresh task showing completed
vpxd logs showing log events for ESXi host "unable to get local issuer certificate", "unable to verify the first certificate"
Host got disconnected due to the expired ESXi certificate after vcenter patch/upgrade, reconnect failed.
Environment
VMware vCenter Server 7.0.x
VMware vCenter Server 8.0.x
VMware vSphere ESXi 7.0.x
VMware vSphere ESXi 8.0.x
Cause
Vcenter upgraded/patched without renewing the expired certificates on ESXi.
Resolution
Option 1:
if vpxd.certmgmt.mode is "thumbprint", please set vpxd.certmgmt.mode to "vmca" or "custom" then restart vpxd service.
Try to refresh/renew ESXi certificate via vCenter using Right-click ESXi Host in Inventory > Certificates > Renew/Refresh
Option 2:
Note: Use this method only when not able to renew/refresh ESXi certificate via vCenter using Right-Click ESXi Host in Inventory > Certificates > Refresh/Renew Certificate
Right-click the host and select Connection > Disconnect from the pop-up menu.
In the confirmation dialog box that appears, click Ok.
Regenerate certificates
For Custom certificates
Create CSR configuration file
cd /tmp
vi csr.cnf
Paste the following content in csr.cnf and Replace the code in Red with the details of the server that you are configuring (ask the customer to fill it). [ req ] default_bits = 2048 default_keyfile = rui.key distinguished_name = req_distinguished_name encrypt_key = no prompt = no string_mask = nombstr req_extensions = v3_req