Renewing Expiring VMCA Self-Signed Machine SSL Certificates on vCenter Servers in an Enhanced Linked Mode (ELM) SDDC Environment
search cancel

Renewing Expiring VMCA Self-Signed Machine SSL Certificates on vCenter Servers in an Enhanced Linked Mode (ELM) SDDC Environment

book

Article ID: 447150

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer VMware vCenter Server 8.0 VMware Cloud Foundation

Issue/Introduction

This article provides the procedure for safely renewing default VMware Certificate Authority (VMCA) auto-signed certificates within an ELM domain managed by an SDDC deployment.

Because SDDC Manager lacks a continuous two-way certificate synchronization engine for default VMCA-managed nodes, certificates must be renewed directly on the individual vCenter Server loop using the native CLI utilities, followed by a manual trust reconciliation from the SDDC Manager dashboard.

The vCenter displays a warning/critical alarm indicating that the Machine SSL certificate is approaching expiration or has expired.

The vCenter instance resides in a multi-node Enhanced Linked Mode (ELM) Single Sign-On (SSO) topology.

Administrative access via the vSphere Client or API integrations may fail if the certificate has fully passed its expiration window.

 

Environment

VMware vCenter Server 8.x

VMware Cloud Foundation 5.x

SDDC Manager 5.2

Cause

The Machine SSL certificate has reached the end of its validity period.

Within an ELM environment, all member vCenters share a unified vmdird replication database. If a single node's certificate expires, it cannot complete mutual cryptographic handshakes with its replication partners, severing cross-vCenter inventory views and breaking management plane orchestration.

Resolution

VMware recommends to have offline Snapshots (virtual machine powered off) of all nodes in the same SSO domain, aka running in ELM replication, before any activity that will include changes in the vCenter Server.

Modifying identity data across an ELM topology carries a high risk of database sync collision. If replication corruption occurs mid-execution, all nodes must be rolled back to the exact same point in time. Single-node rollbacks will permanently corrupt the SSO domain.

 

Prerequisites & Safety Backups

Execute a manual file-based backup via the VAMI (https://<vcenter-fqdn>:5480) for all linked vCenters. Generate a manual configuration backup within the SDDC Manager interface under Administration > Backup Management.

Log into the target vCenter CLI via SSH and confirm healthy replication status by running:

/usr/lib/vmware-vmdir/bin/vdcrepadmin -f showpartnerstatus -h localhost -u administrator@vsphere.local

Note the exact ESXi host running each vCenter VM. Temporarily disable Lockdown Mode on those specific ESXi hosts to ensure direct root client connectivity is available during the outage.

Phase 1: Capturing the Synchronized Rollback Base

  1. Gracefully shut down the guest OS of all vCenter instances in the SSO ring sequentially.

  2. Log directly into the respective ESXi host UI clients via root credentials.

  3. Take an offline snapshot for every vCenter instance.

  4. Power on the vCenter nodes sequentially, waiting for full service initialization (~10-15 minutes per node) before initiating the next

Phase 2: Renewing via the vCenter CLI Utility

  1. Establish an SSH connection to the specific vCenter appliance undergoing renewal and log in as root.

  2. Launch the Certificate Manager utility:

    /usr/lib/vmware-vmca/bin/certificate-manager

  3. Select Option 3 (Replace Machine SSL certificate with VMCA Certificate).

  4. Authenticate using your Single Sign-On credentials (administrator@vsphere.local).

  5. Confirm the displayed default values (FQDN, Organization, IP address) match your environment.

  6. Allow the utility to execute. It will automatically re-issue the VMCA token, update internal endpoint registrations, and cycle all core vSphere services.

Phase 3: Re-Establishing Downstream SDDC Trust

  1. SDDC Manager Sync: Log into the SDDC Manager UI. Navigate to Inventory > Workload Domains and access the affected domain's Certificates tab. Select Establish Trust or refresh the certificate configuration to pull the updated thumbprint.

  2. Aria Suite Remediations: * Log into Aria Operations, edit the vCenter adapter credentials, test the connection, and accept the new SSL thumbprint.

    • Verify integration status inside Aria Operations for Logs.

  3. NSX Manager Re-Alignment: Access the NSX Manager dashboard. Navigate to System > Fabric > Compute Managers. Select the modified vCenter node, click Edit, and manually accept the updated thumbprint to restore green health connectivity.

  4. Data Protection/Backups: Coordinate with your backup administration team to update the SSL security certificate mapping within your data management solution (e.g., Veritas Backup Exec/NetBackup) for the targeted cluster.

Post-Verification & Maintenance Cleanup

Re-enable Lockdown Mode on the ESXi hosts to restore the security baseline.

Monitor environment stability, cross-vCenter vMotion operations, and backup schedules for 24 hours.

Delete all snapshots across all vCenter appliances the following day to eliminate any long-term storage I/O performance penalties.

 

Powered by Wolken Software