vCenter Instance Displays Warning Status in VCF Health in VCF Operations UI

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VCF Operations
• VMware Cloud Foundation

Issue/Introduction

In VMware Cloud Foundation 9.0.2, a Warning status is displayed for the vCenter instance under Infrastructure Operation > VCF Health.

Direct validation within the vCenter User Interface and the vCenter Server Appliance Management Interface (VAMI) shows normal operations with no critical day-to-day failures, except for a generic datastore usage alert.

All registered adapters display a Green status, and collection activities function successfully across all vCenter instances. The warning alert is generated when environment certificates approach expiration within a 60-day window. No specific log file path contains this alert, as the status is tracked dynamically within the VCF Health framework.

Environment

• VMware Cloud Foundation 9.0.2

• VMware vCenter Server 9.0.2

Cause

The Warning status is triggered because the machine SSL and solution user certificates on the data center site vCenter instance are approaching expiration and have less than 60 days of remaining validity.

The following command output confirms the upcoming expiration:

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;

Resolution

To resolve the Warning status in VCF Health, the machine SSL and solution user certificates must be renewed before the scheduled expiration date.

The following high-level process must be performed:

1. Establish an SSH session to the affected vCenter Server instance using root credentials.

2. Execute the certificate validation command to identify all expiring entries within the VECS stores.

   1. for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;

3. Utilize the standard certificate management workflows or the vCert utility to perform the renewal of the machine SSL and solution user certificates. vCert - Scripted vCenter expired certificate replacement

4. Verify that all services restart successfully post-renewal.

5. Confirm that the Warning status within Infrastructure Operation > VCF Health is cleared and displays as healthy.

Additional Information

• Determining expired SSL certificates in vCenter Server 
• Health and alerts provided by VCF Operations