vSAN tabs or status missing in vCenter UI

Products

• VMware vSAN

Issue/Introduction

• vSAN configuration and status tabs are missing in the vCenter UI.

• Navigating to Cluster > Configure > vSAN > Services displays the error: Unable to extract the expected data. Check vSphere client logs for details.

• From vCenter, vsphere_client_virgo.log shows InvalidArgument errors related to isVsanEnabled or isVsanPMemEnabled properties.
  
  ConditionalExtensionPropertyFilteries ConditionPropertiesDataModel(properties=isVsanPMemEnabled, isPoweredoff, isFileServiceEnabled, isVsanEnabled, isIscsiEnabled, isComputeonly, resourceModels=com. vmware. vsan. ClusterModel, objectIds=domain-c8:71248ed1-b720-4835-9bfd-8e8e040d48c1, vcGuid='71248ed1-b720-4835-9bfd-8e8e040d48c1') com.vmware .vapi.std.errors.InvalidArgument: InvalidArgument (com.vmware.vapi.std.errors.invalid_argument) =>messages = [LocalizableMessage (com.vmware.vapi.std. localizable_message) => { id = error.query.coreApiMismatch,

Environment

VMware vCenter Server 7.x / 8.x
VMware vSAN 7.x / 8.x

Cause

The vCenter Machine SSL certificate is expired. This certificate is critical for secure communication between the vSphere Client and internal services like vmware-vsan-health.

From vCenter, /var/log/vmware/applmgmt/applmgmt.log, there is an event for "Certificate verify failed"

2026-07-22T03:11:29 AM UTC [10684]ERROR:vmware. vherd.transport.post_sso_events: Failed to get vcenter server endpoint urls. Err [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired ( ssl. c: 997)
2026-07-22T03:16:29 AM UTC [10684]ERROR:cis. vpxdevent_lib: Failed to get vcenter server endpoint urls Err [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired ( ssl.c: 992026-07-22T03:16:29 AM UTC [10684]ERROR:vmware.vherd. transport.post_sso_events: Failed to get vcenter server endpoint urls. Err [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate hs expired ( ssl.c:997)

Resolution

1. Take an offline snapshot of the vCenter Server Appliance (VCSA).

2. Verify the certificate expiration by running vCerts tool.

3. Replace the expired Machine SSL certificate. Use the vCerts tool for a scripted replacement. Refer to KB 385107

4. Restart vCenter services to load the new certificate: service-control --stop --all && service-control --start --all

Additional Information

Use the lsdoctor tool to check for SSO trust mismatches lsdoctor