vCert reports one of two STS certificates will expire shortly

Products

• VMware vCenter Server

Issue/Introduction

Running a certificate check with the vCert tool shows that one of two STS certificates will expire shortly. 

Single Sign-On Secure Token Service Certificates

TenantCredential-1 Signing Certificate
Issuer: CN=##, DC=##, DC=##, C=##, ST=##, O=##, OU=##
Subject: CN=##, C=##, ST=##, L=##, O=##, OU=##
Not Before: <Date>
Not After : <Date>

TenantCredential-2 Signing Certificate
Issuer: CN=##, DC=##, DC=##, C=##, ST=##, O=##, OU=##
Subject: CN=##, C=##, ST=##, L=##, O=##, OU=##
Not Before: <date>
Not After : <date> -> Shows expiring soon

Environment

vCenter 8.x

vCenter 9.x 

Cause

STS can have two certificates that are used to verify tokens. Only a single certificate can be used to sign tokens. A second certificate can be kept to enable verifying older tokens. 

Note: STS certificate autorenewal introduced in vSphere 8.0 GA only renews the active signing certificate. 

Resolution

If the certificate used to verify older tokens expires there will be no major impact on the environment. After the certificate expires, the STS service will detect it and automatically remove it from the trusted cert chains.

The only caveat is any long running scheduled tasks that were created before the creation date of the new active signing certificate may need to be rescheduled as the token will no longer be valid after expiry. If vCenter has restarted since the start date of the active signing certificate this will not be an issue as all SAML tokens are refreshed on restart.

There are two methods to validate the active STS signing certificate. 

Certificate Management UI in vSphere UI 

1. Follow the steps in View the Active vCenter Server STS Signing Certificate Chain Using the vSphere Client.

Signing certificate API in API Explorer 

1. Connect to the vSphere HTML5 client through https://vcenter_server_ip_address_or_fqdn/ui.
2. In the vSphere Client home page, click Developer Center and select the API Explorer tab.
3. Execute the "GET" call for /api/vcenter/certificate-management/vcenter/signing-certificate