vCert or Fixcerts scripts fail to automatically regenerate SMS certificate on vCenter Server
Article ID: 434877
Updated On:
Products
Issue/Introduction
After launching the vCert or Fixcertsscripts to perform a broad certificate replacement, the SMS (Storage Monitoring Service) certificate is not automatically regenerated or updated.
The certificate retains its old expiration date, and related alarms (e.g., "SMS certificate in VECS has expired") may persist in the vSphere Client.
Environment
vCenter Server 8.x
Cause
Automated "replace all" or "replace expired" workflows within the scripts may skip the SMS store if there are local store inconsistencies or if the service-specific replacement logic fails to trigger automatically.
Resolution
To resolve this issue, the SMS certificate must be targeted individually for regeneration using the vCert utility's management menu.
Prerequisites:
Take an offline snapshot of the vCenter Server. If in Enhanced Linked Mode (ELM), take cold snapshots of all nodes in the domain.
Manual Regeneration Steps:
- Connect to the vCenter Server via SSH as the root user.
- Launch the vCert script:
- Select Option 3 (Manage certificates).
- Select Option 5 (SMS certificates).
- Select Option 1 (Replace SMS self-signed certificate).
- Once the script confirms the replacement is complete, restart the Profile-Driven Storage service to initialize the new certificate:
Additional Information
Feedback
