"Error: The certificate format is invalid" when updating ESXi host certificate in vSphere Client

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to renew or replace an ESXi host certificate with a custom CA-signed certificate via the vSphere Client UI, the process fails during the Import and Replace workflow.

Environment

• Product: VMware vSphere ESXi 8.x and later
• Management: VMware vCenter Server 8.x / 9.x
• Configuration: ESXi hosts managed by vCenter using Custom Certificate Authority (CA) signed certificates.

Cause

The CA-signed certificate file (.crt or .cer) contains descriptive text headers (e.g., "Bag Attributes," "subject=", "issuer=") above the -----BEGIN CERTIFICATE----- marker and below the -----END CERTIFICATE----- marker. 
This data must be edited out of the certificate file before it can be imported to the ESXi host. 

Resolution

Remove the metadata from the certificate prior to importing to the ESXi host .

1. Open the CA-signed certificate file in a plain text editor (e.g., Notepad++, vi).
2. Locate the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags.
3. Delete all text appearing above the BEGIN tag and below the END tag.
   
   • If importing a certificate chain, delete the metadata between the certificates.
   • Example:
     

     <REMOVE METADATA HERE>
     -----BEGIN CERTIFICATE-----
     <alphanumeric certificate characters>
     -----END CERTIFICATE-----
     <REMOVE METADATA HERE>
     -----BEGIN CERTIFICATE-----
     <alphanumeric certificate characters>
     -----END CERTIFICATE-----
     <REMOVE METADATA HERE>
     

4. Save the file. It should now contain only the base64 encoded block

Import the updated certificate to the certificate update menu and proceed with the certificate replacement process. 

 

 

Additional Information

Refer: Replace the Default Certificate with a Custom Certificate Using the vSphere Clien