"The credential could not be regenerated because the certificate was statically set and is not self-signed or is invalid" when attempting to rotate BOSH certificates.

Products

• VMware Tanzu Kubernetes Grid Integrated Edition
• Operations Manager
• VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

When attempting to run either maestro regenerate, or credhub CLI/curl to regenerate a certificate, the below error is returned:

The credential could not be regenerated because the certificate was statically set and is not self-signed or is invalid.

This prevents the certificate from rotating.

Environment

TKGI/TPCF

Resolution

There can be a variety of causes/solutions for this issue, as it depends on state the certificate itself. Please open a case with support including the support bundle, so it can be reviewed and the best solution provided.