Error: "Not Secure" in browsers after replacing Machine SSL certificate with GoDaddy-issued certificate for vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• After replacing the vCenter Server Machine SSL certificate with a GoDaddy-issued certificate (GoDaddy TLS Intermediate CA DV - R1v1), Chrome and Edge browsers report the vCenter web interface connection as "Not Secure".
  
  
• Navigating to the vCenter Server FQDN in modern browsers displays an SSL/TLS trust warning, and inspecting the certificate path reveals an incomplete trust chain.
  
  
• This does not happen when accessing the vCenter Server on Firefox.

Environment

VMware vCenter Server

Cause

An incomplete certificate chain is applied to vCenter Server. A required GoDaddy "Cross" certificate is omitted from the trusted root certificate chain during the initial import process. GoDaddy has introduced a new cross-signed certificate into their root and intermediate chain topology; without it, browsers cannot establish a contiguous path of trust. Below is how the entire chain looks like.

Resolution

1. Obtain the complete certificate chain bundle from GoDaddy, ensuring the new "Cross" certificate is included.
2. Concatenate the Root CA, Intermediate CA, and the new Cross certificate into a single trusted root chain file.
3. Access the vSphere Client and navigate to the Certificate Management section.
4. Execute the Machine SSL replacement workflow again.
5. Supply the existing valid Machine SSL leaf certificate alongside the newly updated trusted root chain containing the Cross certificate.