Accessing vCenter Server fails with error "[400] An error occurred while sending an authentication request to the vCenter Single Sign-On server" due to expired solution user certificates

Products

• VMware vCenter Server 7.0
• VMware vCenter Server 8.0

Issue/Introduction

• Message prompts similar to below are encountered when access vCenter Server web client ui over browser:
  
  [400] An error occurred while sending an authentication request to the vCenter Single Sign-On server - An error occurred when processing the metadata during vCenter Single Sign-On setup - java.lang.reflect.InvocationTargetException
  
  

[400] An error occurred while sending an authentication request to the vCenter Single Sign-On server - An error occurred when processing the metadata during vCenter Single Sign-On setup - com.vmware.vcenter.apigw.api.sso.tokenmgmt.TokenException: Failed to acquire an API GW service-principal token.

• Multiple services including vmware-vpxd and vmware-sps fail to start and /var/log/vmware/vpxd/vpxd.log has below messages:
  
  AcquireToken exception: N9SsoClient27InvalidCredentialsExceptionE(Authentication failed: Invalid credentials)
  
  
• One or more Solution users certificates are found to have expired upon running below command as per Verify and resolve expired vCenter Server certificates using the command line interface :
  
  for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;

Environment

VMware vCenter Server 7.x

VMware vCenter Server 8.x

Cause

Expired Solution user certificates on vCenter Server cause services to fail 

Resolution

Note: Take an appropriate snapshot of the vCenter server VM, referring to Snapshot Best practices for vCenter Server Virtual Machines

To resolve the issue, renew the vCenter Server Solution User certificates using the vCert script with VMCA as the certificate authority. Follow the detailed steps outlined in the VMware KB article: How to replace the vCenter Server Solution User certificates with VMCA issued certificate