Error: "The TLS certificate on this node is not VMCA generated and the renew operation is not supported for third party CA issued certificates" when attempting to renew the machine SSL certificate

Products

• VMware vCenter Server
• VMware Cloud Foundation

Issue/Introduction

• Certificate renew operation fails
• A custom (non-VMCA) certificate is installed and an attempt is made to renew the certificate using the Renew button.

 

Environment

vCenter: 8.0U3

VCF: 5.2

Cause

• This error occurs because the Renew operation is a native VMCA function. If the certificate is "Custom," vCenter lacks the external CA's private key to sign a renewal.
• Furthermore, after a Cross-Domain Repoint, the new VMCA does not recognize certificates issued by the previous domain's VMCA, treating them as third-party.

Resolution

1. Login to the UI as the administrator user

   To revert to a VMCA-managed certificate:

   1. Login to vSphere Client > Administration > Certificate Management.

   2. On Machine SSL Certificate, click Actions > Import and Replace Certificate.

   3. Select Replace with VMCA-issued certificate.

   To maintain a Third-Party certificate:

   1. Generate a new CSR from the Machine SSL Certificate tab.

   2. Have the CSR signed by your External CA.

   3. Select Import and Replace Certificate > Replace with external CA certificate.

   
   

    

Additional Information

• After a cross domain repoint operation, vmafd-firstboot is executed again and a new VMCA certificate is created and the previous VMCA certificate is lost. Even though retained in the TRUSTED_ROOTS store, it will no longer be used as the VMCA to sign new certificates. Due to the above behaviour, the renew API on the TLS certificate will error out.
• This error can also occur if the cross domain repoint was done in the past.
  Note: The cause and resolution in this article applies only if a cross domain repoint operation was performed on the vCenter Server.
  For more information on the cross domain repoint operation, see Repoint vCenter Server to Another vCenter Server in a Different Domain