vCenter Server HTTPS Port Modification Post-Deployment Support and Procedures

Products

• VMware vCenter Server

Issue/Introduction

• Third-party security compliance tools (for example: Netwrix Change Tracker Agent) cannot communicate with vCenter Server due to non-standard HTTPS ports (such as port 444).
• Manual modification of /etc/vmware/rhttpproxy/config.xml allows the reverse proxy to listen on port 443, but internal service dependencies continue to reference the installation-time port.
• The vCenter Server environment remains in an inconsistent or unsupported state after manual port modification attempts.

Environment

• vCenter Server Appliance 8.0 Update 3i
• ESXi 8.0 Update 3i

Cause

HTTP and HTTPS ports are "installed parameters" established during the initial deployment of the vCenter Server Appliance. These values are deeply integrated into the internal service-to-service communication framework and service registrations within the VMware Lookup Service.

There is no supported mechanism or code path to update these hardcoded dependencies post-installation.

Resolution

There is no supported in-place workaround to modify the HTTPS port on an existing vCenter Server deployment. To revert to the standard port 443, you must redeploy the appliance.

Note: A VAMI backup and restore will not resolve this issue. The restoration process re-imports the original network configuration, including any non-standard ports.

To resolve this issue, follow these steps:

1. Deploy a new vCenter Server Appliance using the standard port 443.
2. Manually configure the new vCenter Server instance to match the settings of the source environment.
3. Migrate the ESXi hosts from the old vCenter Server to the newly deployed instance.
4. If you need to reuse the original FQDN or IP address, follow the documented procedures for renaming or re-IPing the appliance after the migration is complete.

Additional Information

Modifying the vCenter Server Appliance (VCSA) HTTPS port after the initial deployment phase is an unsupported operation. While you can manually edit certain configuration files to change the listening port, these changes do not propagate to internal service registrations, such as the VMware Lookup Service. This results in an inconsistent architectural state and prevents communication with security compliance tools or third-party agents that require standard port configurations.

• KB 379742 (Best Practices for changing the IP address of vCenter server) 
• KB 418448 (Update or Change vCenter Server Appliance Hostname/Fully Qualified Domain name (FQDN)/PNID)