Interpreting Certificate Status Anomalies in vCenter Server 7.x and 8.x found using vCenter CLI tools such as the vCert script tool

Products

• VMware vCenter Server

Issue/Introduction

• When checking vCenter Server certificate status via SSH using tools such as the vcert script tool, you may observe the following flags despite the vSphere Client showing a healthy status:
  • VMDir Certificate: Marked as EXPIRED.
  • Auto Deploy CA: Marked as NO SKID.
  • BACKUP_STORE: Showing entries nearing expiration.

Environment

• VMware vCenter Server 7.0.x
• VMware vCenter Server 8.0.x

Cause

• VMDir Certificate: This is a legacy file remnant from earlier vCenter versions. It is no longer utilized in 7.x or 8.x but remains in the file system where health tools may flag it.
• Auto Deploy CA: This certificate (rbd-ca.crt) may lack a Subject Key Identifier (SKID). This is expected if Auto Deploy is not in use.
• BACKUP_STORE: Contains historical backups of previous Machine SSL or Solution User certificates. These are not active but trigger alarms as their stored expiration date approaches.

Resolution

• VMDir Expired Certificate:
  • This remnant has no operational impact. If removal is desired for health-check cleanliness, follow the steps in KB 405319.
• Auto Deploy NO SKID:
  • If you do not use vSphere Auto Deploy, this flag can be safely ignored. If Auto Deploy is required, replace the certificate following KB 410906.
• Clearing BACKUP_STORE Entries:
  • To prevent 'Certificate Status' alarms for inactive backup certs, use the vCert utility as per KB 326268:

1. 1. 1. Download and run the vCert Utility.
      2. Select Option 3 (Manage certificates).
      3. Select Option 12 (Clear BACKUP_STORE entries).

• LDAPS Certificate Renewal
  • If an identity source certificate is expiring, update it to maintain trust:
    • Refer to KB 371578 for manual steps or use vCert Option 3 > Option 11 to update LDAPS certificates without recreating the identity provider.

⚠️ IMPORTANT: Always take a file-based backup and a virtual machine snapshot of the vCenter Server before modifying certificate stores. In Enhanced Linked Mode (ELM), shut down all nodes and take snapshots simultaneously.

Additional Information

• vCert Tool Documentation
• Determining Expired SSL Certificates