vCenter Server update pre-check fails with VECS force refresh Error 1006

Products

• VMware vCenter Server 8.0

Issue/Introduction

When attempting to update the vCenter Server Appliance, the pre-update check validation fails, and the update process cannot proceed.
The following error message is displayed in the vCenter Server Appliance Management Interface (VAMI):

Unable to upgrade as VECS force refresh has failed.
Search for these symptoms in the VMware knowledge base for any known issues and possible workarounds. If none can be found, collect a support bundle and open a support request.

Additionally, if you manually test the internal certificate refresh operation via the command line as root, it fails with "Error 1006" as below :

/usr/lib/vmware-vmafd/bin/vecs-cli force-refresh

Error: Failed to trigger root cert refresh
vecs-cli failed. Error 1006: No object ID has been generated.

Environment

VMware vCenter Server 8.x

Cause

This issue occurs because corrupted certificates or unexpected files are in /etc/ssl/certs/, which interfere with the VMware Endpoint Certificate Store (VECS) and the VMware Authentication Framework daemon (vmafdd).

Resolution

1. Take a file-based backup of the vCenter Server and/or an offline snapshot before making changes (If using Enhanced Linked Mode, please see KB 313886). Deleting or modifying certificate stores (specifically TRUSTED_ROOT_CRLS) can damage the vCenter Server certificate infrastructure.
2. Clean up the invalid files in the /etc/ssl/certs/ directory by using the crl-fix.sh script of KB 322252.
3. Verify that the vecs-cli force-refresh command or the certificate replacement task now completes without Error 1006.
4. Rerun the pre-update check of vCenter Server update.

Additional Information

vPostgres service fails to start on vCenter Server due to several entries in TRUSTED_ROOT_CRLS VECS Store

VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice