Warning: "Certificates will expire within 30 days" for VMCA signed SDDC Manager certificate

Products

• VMware Cloud Foundation

Issue/Introduction

• The SDDC Manager UI dashboard displays the below warning banner: "Certificates will expire within 30 days".

• Clicking on manage on the above banner or  navigating to Inventory > Workload Domains > Management Domain > Certificates shows the SDDC Manager certificate status as "Expiring Soon" or "Expired".
• Additionally, in SDDC Manager CLI running  Supportability and Serviceability (SoS) tool health check command /opt/vmware/sddc-support/sos --health-check reports a failure in the result.json file:

{
"name": "<FQDN/IP SDDC_Manager>",
"status": "FAILED",
"message": "Certificate validation is failed for SDDCMANAGER:<FQDN/IP SDDC_Manager>. If Certificate End date is 15 days or less, SoS will show result as failed.Certificate expires in 8 day(s).",
"errors": "Certificate validation is failed for SDDCMANAGER:<FQDN/IP SDDC_Manager>. If Certificate End date is 15 days or less, SoS will show result as failed.Certificate expires in 8 day(s)."
}

 

Environment

• VMware Cloud Foundation 5.x
• VMware Cloud Foundation 9.x

Resolution

Note: Take a snapshot of the Software-Defined Data Center (SDDC) Manager virtual machine.  Follow the Taking and restoring snapshots of the SDDC Manager appliance for guidance.

1. Generate Certificate Signing Requests

1. In the SDDC Manager UI, navigate to Inventory > Workload Domains > Management domain > Certificates tab.

2. Select the SDDC Manager component, click Generate CSRs, enter the required details, and complete the request.

2. Issue New Leaf Certificates

1. In vCenter, navigate to Administration > Certificate Management > Trusted Root.
2. Select the VMware Certificate Authority (VMCA) Root Certificate and click Issue New Leaf Certificate.
3. Upload the generated CSR, specify the validity period, and download the resulting Leaf and Root certificates to your local system.

3. Install Certificates

1. Back in the SDDC Manager Certificates tab, select the SDDC Manager certificate and click Upload and Install Certificates.
2. Click on Upload and Install Certificates and Upload the new Leaf and Root certificates, click Validate, and once successful, click Install. (Monitor the Tasks panel to verify successful completion).