Persistent Certificate Expiration Alerts in vSphere UI after Machine SSL Replacement

Products

• VMware vCenter Server

Issue/Introduction

After replacing the vCenter Machine SSL certificate with a custom certificate, a "certificates about to expire" alert may persist in the vSphere UI. This issue occurs when an expired issuer certificate remains in the TRUSTED_ROOTS store, causing the UI to trigger a false-positive warning despite the Machine SSL certificate being valid.

Environment

VMware vCenter Server 7.x
VMware vCenter Server 8.x

Cause

An expired issuer certificate is present in the TRUSTED_ROOTS store. When using custom certificate replacement utilities, the existing trust chain is not always fully cleaned, leaving stale root anchors that are validated by the vSphere Client.

Resolution

To resolve this issue, perform the following steps to clean the certificate store:

1. 1. Log in to the vCenter Server appliance via SSH.
   2. Identify the expired issuer certificate in the TRUSTED_ROOTS store: /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store TRUSTED_ROOTS --text | egrep "Alias|Not After"
   3. Remove the expired issuer certificate from the TRUSTED_ROOTS store: /usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store TRUSTED_ROOTS --alias <alias_to_delete>
   4. Add the new, valid signing certificate to the TRUSTED_ROOTS store manually using the vecs-cli tool.
   5. Restart all vCenter services to refresh the UI alert status: service-control --stop --all service-control --start --all

Additional Information

If the alert persists, verify the BACKUP_STORE in VECS for additional stale entries using vecs-cli entry list --store BACKUP_STORE --text.