ESXi 8.X Upgrade compliance check Fails Due to SHA-1 Signature Algorithm

Products

• VMware vCenter Server

Issue/Introduction

Attempting to upgrade ESXi hosts to version 8.0 U3j. The upgrade is currently blocked by remediation pre-check errors citing a weak SHA-1 signature algorithm and vFAT boot bank partition corruption. Errors in vSphere Client Lifecycle Manager pre-check screenshots showing host incompatibility with the target image.

Environment

VMware ESXi 8.X

VMware vCenter Server 8.X

Cause

The pre-check failures are caused by a weak SHA-1 signature algorithm present in the host certificates, vSphere 8.x does not support the SHA1 certificate algorithm. Any certificate on the VCSA or ESXi using a SHA1 signed certificate needs to be removed before upgrading.

Resolution

To address the SHA-1 certificate issue, execute the following steps on the affected ESXi hosts:

1. Connect to the ESXi host via SSH as root and navigate to the SSL directory using the command: cd /etc/vmware/ssl.

2. Validate the current certificate contents by copying them to a text file for review: cat castore.pem > /tmp/cert_validation.txt. Review this text file to confirm the presence of the SHA-1 certificate on the ESXi host before proceeding.

3. Backup the existing certificate store by running: cp castore.pem /castore.pem.bck.

4. Clear the active certificate store by running: echo "" > castore.pem.

5. Log into the vSphere Client and select the affected ESXi host.

6. Navigate to Configure > System > Certificate, and click Refresh CA Certs.

7. Re-run the baseline compliance check to verify the SHA-1 error is resolved.

Additional Information

vCenter Server upgrade from 7.x to 8.x fails due to SHA1 signature algorithm in ESXi certificate chain when ESXi using custom CA certs