Valid root certificate fails to populate in vCenter Server TRUSTED_ROOTS store after a successful replacement of custom MACHINE_SSL certificate

Products

• VMware vCenter Server

Issue/Introduction

After a successful renewal of the MACHINE_SSL certificate on the vCenter Server using a custom, internal CA-signed certificate chain (consisting of the machine certificate, intermediate CA, and root CA), the valid trusted root certificate fails to populate within the TRUSTED_ROOTS VECS store.

When reviewing the environment, the entire custom certificate chain is successfully listed under the MACHINE_SSL VECS store; however, the new valid root certificate remains absent from the TRUSTED_ROOTS store.

Environment

VMware vCenter Server

Cause

This issue occurs because the vCenter Server fails to populate the new valid root certificate into the TRUSTED_ROOTS store due to a cryptographic key collision.

The root certificate was renewed by extending its validity period without generating a new key pair. Consequently, the newly issued root certificate shares the exact same "Subject Key Identifier" as the expired root certificate already present in the VECS store. Because the VECS architecture utilizes the Subject Key Identifier to index and differentiate certificates, the system cannot update or append the new certificate while the stale entry holding the identical key identifier remains published.

Resolution

To resolve this issue, you must clear the conflicting expired root certificate from the VECS store to allow the new certificate to be recognized. This resolves the Subject Key Identifier collision so the VMAFD/VECS services can successfully process and publish the updated certificate chain.

Choose one of the following methods to clear the conflict:

Method 1: Manually replace the certificate

1. Safely unpublish the existing, expired root certificate from the TRUSTED_ROOTS VECS store.
2. Manually publish the newly issued root certificate into the TRUSTED_ROOTS store.
   (Note: Refer to Replace the Expired CA certificate for guidance.)

Method 2: Reset and re-apply certificates

1. Reset all certificates in the environment back to the default VMCA.
2. Clear the expired root certificates from the trusted root store. This can be executed via a scripted method (referencing Removing CA Certificates from the TRUSTED_ROOTS store in the VMware Endpoint Certificate Store(VECS) in vCSA using script) or a manual method (referencing Verify and remove CA Certificates from the TRUSTED_ROOTS store in the VMware Endpoint Certificate Store(VECS)).
3. Re-apply the custom certificate chain. With the expired roots cleared, the TRUSTED_ROOTS store will successfully update with the new valid root certificate. (referencing Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate

Additional Information

To verify If the Subject Key Identifier of the new-valid and old-expired trusted root matches and is same as the Authority Key Identifier of the Machine SSL certificate

1. Capture the Subject Key Identifier for the new-valid and old-expired trusted root certificate:

/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store TRUSTED_ROOTS --text

2. Verify the Authority Key Identifier in the Machine_SSL certificate details:

/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT --text