Active Directory logins to vCenter fail after LDAPS certificate renewal

Products

• VMware vCenter Server

Issue/Introduction

• Users are unable to log in to the vCenter Server vSphere Client using Active Directory (AD) credentials. Logins using local SSO accounts (e.g., [e-mail]) continue to work.
• Authentication failures are also observed in any backup jobs that uses an AD account.
• This issue commonly occurs after the SSL certificate on the external Active Directory Load Balancer or Domain Controller (the LDAPS provider) has been renewed or changed.

Environment

• VMware vCenter 7.x
• VMware vCenter 8.x

Cause

• Active Directory logins fail because vCenter retains an outdated, cached certificate that mismatches the newly renewed certificate presented by the Active Directory Load Balancer.

Resolution

The solution is to re-add the Identity Source configuration in vCenter with the new certificate. This requires you to log in using a local SSO administrator account (like [e-mail]).

Warning: Before removing the identity source, take screenshots of all its settings (Primary server URL, Base DN for users, Base DN for groups, etc.). You will also need to re-add your AD groups to vCenter roles (under "Global Permissions" or other objects) after re-adding the source.

1. Obtain the New AD Load Balancer Certificate. You may need to get this from your network or security team. Save this as a .cer or .crt file.
2. Remove and re-add the identity source.
3. 1. Log in to the vSphere Client as [e-mail]
   2. Navigate to Menu > Administration > Single Sign On > Configuration > Identity Sources.
   3. Select the problematic AD identity source and click Remove.
   4. Click Add to create a new identity source.
   5. Select Active Directory over LDAP.
   6. Fill in all the same configuration details you noted down.
   7. When you reach the Certificates (for LDAPS) section, upload your new certificate file.
   8. Click Save to apply the changes

Additional Information

KB 383112: AD Authentication Failure in vCenter Due to LDAPS Certificate Mismatch

KB 316596: Configuring a vCenter Single Sign-On Identity Source using LDAP with SSL (LDAPS)

Reference : Add or Edit a vCenter Single Sign-On Identity Source