Alarm 'STS Signing Certificates are about to expire' keeps returning even though there are no certificates expiring soon.

Products

• VMware vCenter Server

Issue/Introduction

• VMware vCenter Server alarm 'STS Signing Certificates are about to expire' keeps returning even though there are no certificates expiring soon. 
• The alarm returns within a few minutes after clearing it.
• Under Monitor > Events event as below is noticed :  

Renew STS Signing Certificates: STS Signing Certificate # 0 with Subject C=US, CN='ssoserverSign,dc=vsphere.dc=local" expires in 0 days 

• In applmgmt.log under /var/log/vmware/applmgmt logs repeated events as below every five minutes : 

ERROR:vmware.vherd.transport.post_sso_events:Error: processing archived files
INFO:cis.vpxdevent_lib:Event com.vmware.sso.STSCertExpiry successfully posted to http://localhost:8085/sdk

• In operation_events.log under /var/log/audit/sso-events logs events as below : 

{"user":"n/a","client":"n/a","timestamp":"07/02/2025 19:03:47 GMT","description":"STS Signing Certificate # 0 with subject C=US, CN=\"ssoserverSign,dc=vsphere,dc=local\" expires in 1 days","eventSeverity":"WARNING","type":"com.vmware.sso.STSCertExpiry"}
{"user":"n/a","client":"n/a","timestamp":"07/03/2025 19:03:47 GMT","description":"STS Signing Certificate # 0 with subject C=US, CN=\"ssoserverSign,dc=vsphere,dc=local\" expires in 0 days","eventSeverity":"WARNING","type":"com.vmware.sso.STSCertExpiry"}

Environment

VMware vCenter Server 7.x, VMware vCenter Server 8.x

Cause

This issue is caused by a rare corner case where  operations_events.log file is read in an infinite loop and not cleared up causing the STS certificate expiry Alarm to get generated repeatedly. 

Resolution

The issue is resolved in vCenter Server 7.0 Update 3o and VMware vCenter Server 8.0 Update 2. 

To fix, clear all contents within operation_events.log under /var/log/audit/sso-events : 

# cp /var/log/audit/sso-events/operation_events.log /var/log/audit/sso-events/operation_events.log.Back
# > /var/log/audit/sso-events/operation_events.log

 

After that, reset the "STS Signing Certificates are about to expire" Alarm to green from the UI.  

Additional Information

• Using VDT tool to verify certificate and health check.