Error: "Certificate(s) in VECS TRUSTED_ROOTS store has expired KB 385107" alarm in vCenter Server
search cancel

Error: "Certificate(s) in VECS TRUSTED_ROOTS store has expired KB 385107" alarm in vCenter Server

book

Article ID: 416354

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

  • A certificate expiration alarm is visible in vCenter, referencing the VECS TRUSTED_ROOTS store.

  • This occurs in both standalone vCenter and VMware Cloud Foundation (VCF) environments when expired CA certificates remain in the trust store after a previous certificate renewal or replacement operation.

  • The vSphere Client displays the following error: Certificate(s) in VECS TRUSTED_ROOTS store has expired KB 385107

  • These leftover certificates do not affect day-to-day operations but generate persistent alarms. If left unresolved, they can cause validation failures during future certificate operations, upgrades, or VCF workflows.

Additional symptoms reported:

  • VCF vCenter displays the expired certificate alarm, but SDDC Manager shows no expired certificates.

  • Alarm persists after reviewing certificates in SDDC Manager UI.

Environment

  • VMware vCenter Server 8.x
  • VMware Cloud Foundation (VCF) 5.x
  • VMware Cloud Foundation (VCF) 9.0

Cause

  • When certificates are renewed or replaced in vCenter, the old CA certificates in the TRUSTED_ROOTS store are not automatically removed.
  • These remnants remain valid entries in the VMware Endpoint Certificate Store (VECS) until they expire. Once expiration occurs, vCenter triggers a certificate status alarm for these entries, even though they are no longer in active use.
  • In VMware Cloud Foundation (VCF) environments, vCenter and SDDC Manager maintain independent trust stores with no synchronization between them.
  • An expired certificate exists in one trust store but not necessarily the other, explaining why SDDC Manager shows no certificate issues while vCenter displays the alarm.

Resolution

Prerequisites

  1. Take a powered-off snapshot of the vCenter Server Appliance.
  2. For Enhanced Linked Mode environments, review VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice
  3. For VMware Cloud Foundation environments, also take a powered-off snapshot of the SDDC Manager appliance.

Option A: Remove expired certificates using the vCert tool

  1. Install vCert on the vCenter Server Appliance using the steps in vCert - Scripted vCenter expired certificate replacement.
  2. Run the tool: ./vCert.py
  3. Select Manage Certificates.
  4. Select CA certificates in VMware Directory.
  5. Review the certificate list and identify expired certificates by their end dates.
  6. Enter the corresponding numbers for the expired certificates to remove them (separate multiple entries with commas).

Option B: Remove expired certificates manually

  1. Follow the steps in Verify and remove CA Certificates from the TRUSTED_ROOTS store in the VMware Endpoint Certificate Store(VECS) to remove the expired CA certificates from the TRUSTED_ROOTS store using vecs-cli and dir-cli commands.

Additional steps for VMware Cloud Foundation environments

vCenter and SDDC Manager maintain independent trust stores. After removing expired certificates from vCenter, verify whether the same expired certificates exist in SDDC Manager.

  1. Follow the steps under "To delete a stale certificate in trust store" in How to add/delete Custom CA Certificates to SDDC Manager and Common Services trust stores to check for and remove any expired certificates from the SDDC Manager trust store.

Verification

  1. In the vSphere Client, navigate to the Monitor tab.
  2. Locate the certificate status alarm and select Reset to Green to clear the triggered alert.

Additional Information

Related articles:

Powered by Wolken Software