When upgrading SDDC manager to version 5.2.1 the upgrade hangs at Refresh Custom Certificates stage after the task of rebooting the SDDC Manager completes.
VCF 5.x
SSH being disabled on the Management vCenter will cause this error. SDDC Manager must be able to log into the Management vCenter with SSH.
Enable SSH on Management vCenter.
If SSH is enabled, also review KB 386304. https://knowledge.broadcom.com/external/article/386304/sddc-manager-upgrade-from-511-to-521-fa.html