vCenter UI is not accessible with Error: "HTTP Status 500 - Internal Server Error"

Products

• VMware vCenter Server

Issue/Introduction

• vCenter UI is not accessible 
• vCert/VDT report shows the STS certificate with  "Key Usage" value instead of "Valid" or "Expired"

Environment

• vCenter 7.x
• vCenter 8.x

Cause

Security Token Service (STS) misconfiguration: The active certificate is missing its key values.

Resolution

Note:  Before proceeding, ensure you have a valid VAMI-based backup or offline snapshots of ALL vCenters in the SSO domain (ELM group). Refer to the following Knowledge Base article: VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

Use the  vCert - Scripted vCenter Expired Certificate Replacement script to replace the STS Certificates:

1. 1. Select option 3 - Manage Certificates
   2. Select option 8 - STS signing certificates
   3. Select option 1 - Replace STS Signing certificate with a VMCA-signed certificate