on vCenter server KMS certificate is about to expire for FORTANIX

Products

• VMware vCenter Server 6.0
• VMware vCenter Server 7.0
• VMware vCenter Server 8.0

Issue/Introduction

KMS certificate has expired or is about to expire warning within the vCenter web portal 

Environment

VMware vCenter Server 7.x
VMware vCenter Server 8.x

Resolution

• Create a snapshot of the vCenter (NOTE: If the vCenter is in Enhanced Linked Mode with any other vCenter appliances, offline snapshots must be taken of all linked vCenters)
• Get the KMS server UUID from Fortanix DSM (Fortanix portal) or from the expired/expiring certificate in VECS
• Create a certificate in vCenter (using openssl in vCenter server)
• Run the below command in vCenter (Edit the respective attributes based on the environment )

export FORTANIX_APP_UUID=########
               openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 \
   -days 365 -out certificate.crt -subj \
   "/C=US/ST=California/L=Mountain View/O=Fortanix, Inc./OU=SE/CN=$FORTANIX_APP_UUID"

• Share the file certificate.crt with Fortanix to trust the certificate 
• Once the certificate is trusted from Fortanix , update the certificate on vCenter under KMS using the documentation below -
  
  Adding KMS certificate chain for KMS server to set up trust between vCenter and KMS
  Add a KMS to vCenter Server 8.0