"The OVF package contains advanced configuration options, which might pose a security risk" with "The Certificate is Expired" warning for vSAN ESA/OSA Witness Appliance OVF deployment.
Article ID: 424188
Updated On:
Products
Issue/Introduction
On the vSphere Client, Deploy OVF Template wizard task for an vSAN ESA/OSA Witness Appliance fails reports warning:
The OVF package contains advanced configuration options, which might pose a security risk. Review the advanced configuration options below. Click next to accept the advanced configuration options.
And additional warning:
On vSphere 8 and VCF 9: "The Certificate is Expired"
On vSphere 7: "The Certificate is not trusted"
Environment
vSAN 7.x
vSAN 8.x
vSAN 9.x
Cause
The Signing Certificate used for signing the currently-available vSAN Witness Appliance OVFs during the build process expired on January 3rd 2026.
As a result of this, new vSAN Witness Appliance deployments using vSphere Deployment/OVF Tool will fail.
Resolution
This is a known issue impacting VMware vSAN Witness Appliance.
To workaround this issue, in the vSphere Client, click "Ignore" to acknowledge the warning.
Deploy OVF wizard can then continue and the vSAN Witness appliance deployment via the vSphere UI will complete successfully.
Additional Information
Feedback
