Re-establishing VMware HCX Trust After vCenter RSA 3072-bit SSL Certificate Replacement
search cancel

Re-establishing VMware HCX Trust After vCenter RSA 3072-bit SSL Certificate Replacement

book

Article ID: 448161

calendar_today

Updated On:

Products

VMware HCX VMware vCenter Server

Issue/Introduction

  • VMware HCX loses TLS trust with VMware vCenter Server when the vCenter Machine SSL (TLS) certificate is replaced.
  • This scenario frequently occurs when adopting vSphere 8.0 Update 3, which establishes RSA 3072-bit public keys as the default for VMCA-generated self-signed certificates.
  • While the HCX appliance natively supports RSA 3072-bit cryptography, it will not automatically accept a new vCenter certificate, resulting in connectivity and site pairing failures.

Environment

  • VMware HCX
  • VMware vCenter Server 8.0 and higher

Cause

  • Any time the vCenter Server Machine SSL certificate is replaced, the existing TLS trust framework is broken.
  • Manual administrative intervention is required to explicitly accept the new certificate and re-establish trust within the HCX Appliance Management UI.

Resolution

VMware HCX officially supports RSA key sizes from 2048-bit to 8192-bit for vCenter Machine SSL certificates, including the 3072-bit default used in vSphere 8.x.

Follow these steps to re-establish trust after replacing a vCenter certificate:

  1. Log into the HCX Appliance Management UI by navigating to https://<HCX-Manager-IP-or-FQDN>:9443 and authenticate as the admin user.

  2. Navigate to the vCenter Server configuration section and click Edit. (Credential modifications are not necessary if the service account details remain unchanged.)

  3. Proceed with the configuration wizard. The HCX Manager will reach out to the vCenter Server, detect the new RSA 3072-bit Machine SSL certificate, and prompt with a certificate warning.

  4. Confirm and import the new certificate.

  5. Allow the HCX services (including the app-engine and vSphere Web Client service) to automatically restart to apply the new keystore parameters.

  6. Log into the standard HCX UI at https://<HCX-Manager-IP-or-FQDN>:443.

  7. Navigate to Infrastructure > Site Pairs and edit the site pairing configuration to accept the new remote certificate.

  8. Ensure the applied certificate strictly adheres to standard VMware constraints:

    • Subject Alternative Name (SAN) must contain DNS Name=<vCenter_FQDN>.

    • Key Usage / EKU must be correctly defined for Server Authentication.

    • The signature algorithm must be SHA-256 or higher (SHA1 and MD5 are deprecated).

    • The complete certificate chain (Leaf/Server -> Intermediate -> Root) must be imported correctly if using a custom CA.

Additional Information

vSphere 8.0 Update 3, VMware made RSA 3072-bit the default key length for VMCA-generated self-signed certificates

Using vSphere Certificate Manager to Replace SSL Certificates

Powered by Wolken Software