VMware Cloud Director cell services do not start after reboot or service restart

Products

• VMware Cloud Director

Issue/Introduction

• VMware Cloud Director (VCD) Provider portal, VCD VAMI and API explorer may not be available
• Certificate was replaced recently
• In /opt/vmware/vcloud-director/logs/cell-runtime.log you see one of the errors reported below:

  Key protection algorithm not found: java.security.KeyStoreException: Certificate chain is not valid

  OR

  2026-05-28 11:58:05,799 | FATAL | Module: com.vmware.vcloud-common-cell-impl | ModuleRegistry | Error in module: "com.vmware.vcloud-common
  -cell-impl"; Bean: jmxConnector, Message: Error creating bean with name 'jmxConnector' defined in class path resource [META-INF/spring/common-cell-jms-contex
  t.xml]: Invocation of init method failed; nested exception is java.io.IOException: Cannot bind to URL [rmi://##.##.##.##:8999/jmxrmi]: javax.naming.Communi
  cationException [Root exception is java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is:
          javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed]
  [...]
  Caused by: java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is:
          javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity
   check failed
  [...]
  Caused by: java.security.cert.CertificateExpiredException: NotAfter: [Expiration_date]

Environment

VMware Cloud Director 10.6.x

Cause

The issue occurs when the HTTP or JMX certificate have expired for one or more VCD cells.

Resolution

Starting with VMware Cloud Director 10.5.1, you can manage the cell HTTP certificate using the Service Provider Admin Portal and the cell management tool's certificates command is deprecated. The certificates can be renewed following the documentation Certificate Management in the VMware Cloud Director Appliance

If the issue occurred after replacing the HTTP or JMX certificate, revert the VCD cells to the snapshots taken prior to the certificate replacement and restart the certificate replacement.

In cases where the Service Provider Admin Portal is not accessible and the VCD cells cannot be reverted to the snapshot taken before replacing the certificate, contact Broadcom Support and note this Article ID (378898) in the problem description. For more information, see Creating and managing Broadcom support cases.

Additional Information

For more information, see SSL Certificate Creation and Management of Your VMware Cloud Director Appliance.