Error: MACHINE_SSL_CERT certificate in VECS is about to expire alarm - VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• The vSphere Client UI triggers a proactive alarm when a certificate in the VMware Endpoint Certificate Store (VECS) approaches the expiration date. This triggers the "MACHINE_SSL_CERT certificate in VECS is about to expire" alarm in the vCenter Server as shown below:

• This expiration leads to connectivity and authentication failures with external services, such as backup or monitoring tools.

• Logs indicate SSL handshake failures or "remote certificate was rejected" errors.

• If the alarm is not addressed in 30 days, in the vCenter Server Summary tab, the following alarms are reported:

  Authorization data sync failure

  MACHINE_SSL_CERT certificate in VECS has expired.

Environment

• VMware vCenter Server 7.x
  
  
• VMware vCenter Server 8.x

Cause

The vCenter Server monitors VECS certificates and triggers a warning alarm by default 30 days prior to expiration. The MACHINE_SSL_CERT certificate provides secure communication, and once this certificate enters the expiration window, some external agents often treat the connection as untrusted.

Resolution

1. Create snapshot of the vCenter Server Appliance VM as per Snapshot Best practices for vCenter Server Virtual Machines
   
   
2. Use the vCert utility to replace the MACHINE_SSL_CERT. Refer to vCert - Scripted vCenter expired certificate replacement.
   
   
3. Alternatively, use the vCenter Server UI to replace the expiring self-signed Machine SSL Certificate. Refer to Steps to replace MACHINE_SSL_CERT on vCenter server using default VMCA root certificate on vCenter Server UI.
   
   
4. For a custom certificate authority (CA) signed Machine SSL certificate, follow Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate or vCenter Machine SSL Certificate Replacement with Custom CA-Signed Certificate via vSphere Client UI.
   
   
5. After the new certificates function correctly, manually reset the alarm status to green in the vSphere Client, as it does not clear automatically.

Additional Information

Clearing Expired BACKUP_STORE Certificates

If the alarm persists, an expired MACHINE_SSL certificate might exist in the BACKUP_STORE.

• To clear expired certificates from the BACKUP_STORE, refer to Certificate Status Alarm - Clearing BACKUP_STORES certificates in the VCSA.

vSphere Client UI における VECS 内の MACHINE_SSL_CERT 証明書期限切れ間近のアラーム