The WCP service fails to start after a certificate replacement in vCenter Server 7.x

Products

• VMware vCenter Server

Issue/Introduction

• After replacing an expired MACHINE_SSL_CERT on vCenter Server, the Workload Control Plane (WCP) and ESX Agent Manager (EAM) services continue to report certificate expiration errors and fail to establish connections.
  
  
• The following log events are seen in the /var/log/vmware/wcp/wcpsvc.log of the vCenter Server:
  
  Err Post https://vc-fqdn:443/sdk: x509: certificate has expired or is not yet valid error wcp ... Failed to get HOK signer: Post https://vc-fqdn/sts/STSService/vsphere.local: x509: certificate has expired or is not yet valid
  
  
• The below log entries are seen in the /var/log/vmware/eam/eam.log of the vCenter Server:
  
  ERROR | vim-monitor | VcConnection.java | Failed to login to vCenter as extension. vCenter has probably not loaded the EAM extension.xml yet.: Cannot complete login due to an incorrect user name or password.

Environment

VMware vCenter Server 7.x

Cause

This issue occurs because the WCP service (written in Go) and the EAM service may maintain stale connection caches or file-system copies of the previous certificate. If the certificate expires before the reset/replacement operation is performed, the services may fail to dynamically reload the new certificate from the vCenter endpoint or the VECS (VMware Endpoint Certificate Store).

Resolution

To resolve this state, a manual restart of the affected services is required to force a reload of the current certificate chain.

1. Log in to the vCenter Server Appliance (VCSA) via SSH as root.
   
   
2. Stop and start the WCP and EAM services to clear the stale connection state:
   
   service-control --stop wcp
service-control --stop vmware-eam
service-control --start vmware-eam
service-control --start wcp


3. Verify that the wcpsvc.log no longer shows x509 errors and that EAM successfully logs into vCenter as an extension.

Note: If the issue persists after replacing all certificates using the certificate-manager utility, ensure that the service registration endpoints have been correctly updated with the new ssltrust values.