vSphere client and VAMI URL are inaccessible with message 'Your clock is ahead'

Products

• VMware vCenter Server

Issue/Introduction

• When trying to access vSphere Client and vCenter Server Appliance Management Interface (VAMI) URL from a browser, the URL fails to load with the following error message:

Your clock is ahead

A private connection to <vCenter_FQDN> can't be established because your computer's date and time (Day, Month DD, YYYY at HH:MM:SS AM/PM) are incorrect.

NET::ERR_CERT_DATE_INVALID

Subject: <vCenter_FQDN>

Issuer: <Certificate issuer>

Expires on: Mon DD, YYYY

• All the vCenter Server services will be in a running state.
• The 'Expires on' date showed in the error message is of a past date.
• Validating the vCenter Certificate validity using the following command will show the Machine_SSL certificate as expired. 

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;

Environment

• vCenter 8.x

Cause

• As the vCenter Server services were still running while the vCenter Machine_SSL certificate was expired, accessing the vSphere client or VAMI URL in a rare scenario triggers 'Your clock is ahead' message when the client's (local computer) system clock or vCenter server's clock is out of sync with the certificate validity period, causing a mismatch in expected timelines. The browser may infer the clock is incorrect rather than immediately confirming certificate expiry.

Resolution

1. Take snapshot of the vCenter Server Appliance as per the best practices. Refer: VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

2. Use certificate management tool vCert - Scripted vCenter Expired Certificate Replacement to renew vCenter Machine_SSL certificate. 

• • Once the vCert.py is copied in to vCenter Server Appliance, execute the command:

./vCert.py

• • Use option 3 for "Manage Certificates" to list all options to manage certificates. 

  • Use option 1 "Machine SSL certificate" to replace only Machine_SSL certificate.

  • Under "Select Machine SSL Certificate Replacement Method", use 1 for "Replace Machine SSL certificate with a VMCA-signed certificate"

  • After the certificate renewal is completed, select "Restart all VMware services" and type Y to restart all services.