Disable certificate auto-renewal on vCenter Server

Products

• VMware vCenter Server 8.0

Issue/Introduction

Starting with VMware vCenter 8.0 Update 3h, SSL certificates that the VMware Certificate Authority (VMCA) issues for vCenter and ESXi of version 8.0 Update 3 and later are automatically renewed near the expiration date. Administrative teams may require this feature to be disabled to prevent automatic service restarts during production hours or to ensure manual oversight of the certificate lifecycle. If left enabled, the VMware Certificate Authority (VMCA) will trigger a renewal and service restart automatically when the certificate enters its expiration window.

Environment

VMware vCenter Server 8.0

Cause

The parameter vpxd.certmgmt.certs.autoRenewEnabled is set to True by default. This setting directs the vCenter Server to automatically renew the Machine SSL and Solution User certificates using the internal VMCA.

Resolution

Follow these steps to disable the certificate auto-renewal feature:

1. Log in to the vSphere Client with administrator privileges.
2. Select the vCenter Server object in the inventory tree.
3. Navigate to the Configure tab.
4. Under the Settings section, select Advanced Settings.
5. Click Edit Settings.
6. In the search box, enter the following parameter: 
   vpxd.certmgmt.certs.autoRenewEnabled
7. Change the value from True to False.
8. Click Save.

Note: Disabling this setting requires administrators to manually monitor certificate expiration and perform renewals via Administration > Certificate Management or the vCert utility before the certificates expire to avoid service interruption.

Additional Information

It is recommended to capture an offline (powered-off) snapshot of the vCenter Server Appliance before performing manual certificate renewals. Review VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice for additional details.