Diagnostics certificates panel in Aria Operations showing expired certificates that are not in use.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Expired certificates showing up under Diagnostics -> Certificates in Aria Operations. 
  
  
• These certificates are not present under Administration -> Control Panel  an appear to be not in use or have been previously replaced.
  
  
• When removed directly from the database, they appear in the next polling cycle. 

Environment

Aria Operations 8.18.X

Cause

The VMware Infrastructure Health collection logic executes openssl commands against localhost:443 instead of the externally-facing <IP_ADDRESS>:443
Discrepancies between the internal and external httpd service configurations cause the internal request to return invalid certificates that is different from the active service certificate.

Resolution

This behavior is not expected in versions 9.x as the appliance certificate collections are performed by the Fleet Manager appliance, which skips these local collections.

To resolve this issue follow the below steps for Aria Operations 8.18.x :

1. Navigate to Diagnostics > Certificates > View Details
2. Click on the row containing the cert you want to delete to open its details.
3. Copy the thumbprint for the certificate
4. Navigate to Operations > Configurations > Inventory Management
5. Paste the thumbprint in the search box (or open the search filter and manually enter details to narrow scope to the specific object)
6. Click the row for the certificate to be deleted
7. Click Start Maintenance icon on the top toolbar and select the "I will return to end maintenance myself" option.
8. Refresh the Diagnostics > Certificates > View Details page to verify the certificate object is no longer displayed.