ESXi host certificate expiration date does not renew in vCenter

Products

• VMware vCenter Server

Issue/Introduction

When renewing or refreshing an ESXi host certificate (VMCA) from the vSphere Client, the task completes successfully, but the "Valid To" date of the certificate remains unchanged. This typically occurs in vSphere 8.0.3 environments where the signing VMCA Root CA certificate is approaching its own expiration date. The vCenter vpxd.log shows the certificate manager truncating the leaf certificate validity to match the Root CA's expiration.

Symptoms:

• vCenter displays the alarm: "ESXi Host Certificate is about to expire".
• Certificate renewal tasks complete without errors in the task console.
• The Machine SSL certificate on the ESXi host retains the old expiration date.
• vpxd.log contains entries indicating the certificate validity is constrained by the issuing authority.

 

Environment

VMware vCenter Server 7.x / 8.x/ 9.x
VMware ESXi 7.x / 8.x/ 9.x

Cause

An ESXi host certificate cannot have a validity period exceeding the expiration date of the VMCA Root certificate that issues it. If the VMCA Root is expiring (e.g., within months), all renewed host certificates are truncated to that same expiration date.

Resolution

To extend the validity of the host certificates, you must first refresh the VMCA Root certificate using the vCert utility.

1. Create a file-level backup or snapshot of the vCenter Server Appliance.
2. Download the vCert utility from KB 385107.
3. Upload vCert to the vCenter Server. 
4. Run the utility: ./vcert.
5. Select Option 3 (Manage Certificates).
6. Select Option 9 (Advanced Operations).
7. Select Option 2 (Replace VMCA Root and all Certificates) to generate a new 10-year VMCA Root.
8. Restart all vCenter services when prompted. 
9. Navigate to the vSphere Client, right-click the impacted ESXi host, and select Certificates > Renew Certificate.

The host certificate now reflects the full 5-year validity period.

Additional Information

vCert - Scripted vCenter expired certificate replacement
Renew or Refresh ESXi Certificates