Cannot change the host configuration error while replacing the custom SSL certificate on ESXi host from VCF Operations.

Products

• VMware vSphere ESXi

Issue/Introduction

• While replacing the certificate for ESXI host FROM VCF Operations shows an error below 
  

  Error Code: esx.cert.replacement.error
  esx.cert.replacement.error
  Certificate task REPLACE_CERTIFICATE for <hostname> has failed. Error message: Unexpected
  error during certificate replacement for for bulkTakld = #######-####-####-####-############, subTaskld = #######-####-####-####-############ on ESXi host <hostname>. Cannot change the host configuration.
  or 
  Error Code : 'LCMREPLACECERTSERROR'

• Validating the task for ESXI host on vCenter shows
  

  Cannot change the host configuration.
The generated private key does not match with the public key from the incoming certificate.

• Replacing default ESXi SSL certificates with custom CA certificates fails via the vSphere Client UI with the following error:
  

  Operation failed. Cannot change the host configuration. Low-level system error. See logs for details.
  

• In the var/run/log/hostd.log, you will find entries similar to:
  

  In(166) Hostd[ID]: [Originator@6876 sub=Vimsvc.TaskManager opID=OP_ID sid=SESSION_ID user=USER:DOMAIN\USER] Task Created : haTask -- vim.host.CertificateManager.installServerCertificate-6498710
  
   Er(163) Hostd[ID]: [Originator@6876 sub=Vimsvc.CertMgr opID=OP_ID sid=SESSION_ID user=USER: DOMAIN\USER] Failed to get private key: error: 1E08010C: DECODER routines :: unsupported
  
   In(166) Hostd[ID]: [Originator@6876 sub=AdapterServer opID=OP_ID sid=SESSION_ID user=USER: DOMAIN\USER] AdapterServer caught exception; << GUID, <TCP 'IP_ADDRESS: PORT'>, <TCP 'IP_ADDRESS : PORT'>>, ha-certificate-manager, vim.host.CertificateManager.installServerCertificate, <vim. version.v8_0_3_0, internal, 8.0.3.0>, [HEX_ADDRESS]>, N3Vim5Fault15HostConfigFault9ExceptionE (Fault cause: vim. fault. HostConfigFault
   In(166) Hostd[ID] : -- > )
   In(166) Hostd[ID]: -- > [context]ENCODED_DATA[/context]
   In(166) Hostd[ID]: [Originator@6876 sub=Vimsvc.TaskManager opID=OP_ID sid=SESSION_ID user=USER:DOMAIN\USER] Task Completed : haTask -- vim.host. CertificateManager. installServerCertificate-6498710 Status error

• Validating the private key generated on the ESXi host during the Certificate Signing Request (CSR) process is missing at path /etc/vmware/ssl on host

Environment

VCF Operations 9.x

VMware vSphere ESXi 8.x

Cause

The private key generated on the ESXi host during the Certificate Signing Request (CSR) creation is missing or has been overwritten, preventing the certificate import sequence from validating the newly issued certificate.

Resolution

1. Generate a new Certificate Signing Request (CSR) for the affected ESXi host via the vSphere Client.
2. Submit the newly generated CSR to your Internal Certificate Authority (CA) for signing.
3. After the CA issues the custom certificate, import it to replace the ESXi certificate using the vSphere Client.

Additional Information

Step by Step Process to replace ESXi vmca certificates to Custom from vCenter UI

Generate a Certificate Signing Request for a Custom Certificate Using the vSphere Client

Replace the Default Certificate Using the vSphere Client