Refresh or Renew of ESXi host certificate (VMCA) from the vCenter Server UI doesn't change the Machine certificate of the host

Products

• VMware vSphere ESXi

Issue/Introduction

• ESXi host is marked with an alarm stating "ESXi Host Certificate Status" when the host certificate is nearing or past its expiration date.
• Right-click on the ESXi Host in Inventory > Certificates > Renew/Refresh Certificate in the vCenter Server UI, this task shows completed however the actual Machine certificate doesn't change (Validity remains the same)

NOTE: This KB is applicable only if the ESXi host is using the VMCA self signed certificate 

Environment

VMware vSphere ESXi 7.x/8.x

Cause

This issue typically stems from the VMCA (VMware Certificate Authority) Root Certificate cannot issue a leaf certificate with an expiration date exceeding its own. Any service or machine certificates it generates will automatically inherit a truncated lifespan shorter than the system default.

Note : If the VMCA certificate is about to expire in 7 months, then the leaf certificate expiration will be the same as the VMCA expiration.

Check the validity of the VMCA root certificate either from vSphere Client or CLI.

From vSphere UI:

1. Log in to vSphere Client
2. Click on the Hamburger icon and navigate to Administration --> Certificate Management --> Trusted Root
3. Under Trusted Root expand the entry where the certificate Name is VMCA_ROOT_CERT to check the expiration date

From CLI:

1. Take SSH session to the vCenter Server
2. Execute the below command to validate the expiration of VMCA root certifcate

openssl x509 -in /var/lib/vmware/vmca/root.cer -text -noout |grep "Not After"

Resolution

Note: A new improved certificate management/replace tool vCert - Scripted vCenter Expired Certificate Replacement is  available. You are encouraged to use vCert to manage all the certificates and related workflows including the workflow of replacing Solution User Certificates. 

Using vCert Tool to manage and replace VMCA root Certificate on vCenter Server Appliance

1. Download and install vCert on the vCenter Server Appliance as described in Installation Section
2. Replace the VMCA root certificate using the below options
   
   Option 3 Manage certificates -> Option 9 VMCA certificate -> Option 1 Replace VMCA certificate with a self-signed certificate

Note: In case if all the certificates are being generated by the VMCA root certificate and there are no custom certificates in use, proceed to replace all certificates using:

Option 3 Manage certificates -> Option 9 VMCA certificate -> Option 2 Replace VMCA certificate with a self-signed certificate and regenerate all certificates