ESXi vSAN Management Daemon (vsanmgmtd) crashes due to missing SSL certificates in the ESXi host.

Products

• VMware vSAN

Issue/Introduction

Symptoms:

A critical Skyline Health alert "Hosts with connectivity issues" is triggered on the vSAN cluster for specific ESXi host. The vSAN Management Daemon (vsanmgmtd) and vSAN Performance Service (vsanperfsvc) remain in a stopped state on the affected ESXi host and fail to initialize upon manual start attempts.

Executing the command "esxcli vsan cluster get" directly on the affected ESXi host fails with the error: [Errno 2] No such file or directory

Environment

VMware vSphere 9.0 GA
VMware vSAN 9.0 GA

Cause

The vsanmgmtd service crashes upon startup due to a Crypto Exception. This occurs because the host’s primary SSL certificate files (rui.crt and rui.key) are physically missing from the /etc/vmware/ssl/ directory due to a failed automated certificate renewal process.

The following can be noticed on the vsanmgmtd logs when the user try to start the service. 

2026-05-27T05:19:59.115Z Er(11) vsand[####]: [opID=MainThread vsanperfsvc::main] vsan mgmt daemon start fail.
2026-05-27T05:19:59.115Z Er(11)[+] vsand[####]: Traceback (most recent call last):
2026-05-27T05:19:59.115Z Er(11)[+] vsand[####]:   File "/usr/lib/vmware/vsan/perfsvc/vsanperfsvc.py", line 224, in main
2026-05-27T05:19:59.115Z Er(11)[+] vsand[####]:   File "/usr/lib/vmware/vsan/perfsvc/VsanMgmtSvcMain.py", line 453, in InitServer
2026-05-27T05:19:59.115Z Er(11)[+] vsand[####]: RuntimeError: Crypto Exception: error:80000002:system library::No such file or directory:unable to load /etc/vmware/ssl/rui.crt

Resolution

To resolve the issue, the user should do the following.

• Access the affected ESXi host via SSH and navigate to the SSL directory: cd /etc/vmware/ssl/

• Rename the backup certificate files to their original active filenames: mv rui.crt.bkp rui.crt mv rui.key.bkp rui.key

• Allow the ESXi watchdog to detect the restored files and automatically restart the vsanmgmtd service.

• In the vSphere Client, select the Host > Configure > System > Certificate and click Renew Certificate to ensure the host receives a fresh VMCA certificate.

• Repeat this procedure proactively for any identically impacted hosts in the vSAN cluster.

 

Additional Information

• vSAN health check: vSAN Health Service - Network Health - Hosts with connectivity issues
• Renew Certificates: Manually Renew Certificates in VMware Cloud Foundation
• For instructions on retrieving logs, see How to collect vSAN support bundles.
• To speak with a customer representative or a Support Engineer, see Contact Support.
• Subscribe to this article to receive updates: How to subscribe to Knowledge Management articles.