Error: SHA-1 signature found in host certificate False during ESXi 8.0 patch Compliance Check error due to resource exhaustion

Products

• VMware vSphere ESXi
• VMware vCenter Server 8.0
• VMware SDDC Manager / VCF Installer

Issue/Introduction

When attempting to patch ESXi hosts using vSphere Lifecycle Manager (vLCM) / SDDC Manager, the compliance pre-check fails with the following error:
"SHA-1 signature found in host certificate False. Support for certificates with weak signature algorithm SHA-1 has been removed in ESXi 8.0."

This is a false-positive error occurring during the vLCM pre-check process.

Verification:
To confirm this is the cause, check the /var/run/log/vmkernel.log on the affected ESXi host for "Admission failure" errors related to the settingsd-task-forks resource pool:

Example log entry:
YYYY-MM-DDTHH:MM:SS.025Z In(182) vmkernel: cpu##:######)UserWorld 'python' ###### with cmdline '/usr/bin/python /usr/lib/vmware/lifecycle/bin/imagemanagerctl.py software --scan --software-spec /var/run/lifecycle.scan.swspec --depot http://VC_FQDN
YYYY-MM-DDTHH:MM:SS.025Z In(182) vmkernel: cpu##:######)uw.###### (######) requires 256 KB, asked 256 KB from python.###### (######) which has 322380 KB occupied and 180 KB available.
YYYY-MM-DDTHH:MM:SS.025Z In(182) vmkernel: cpu##:######)Admission failure in path: host/vim/vmvisor/settingsd-task-forks/python.######:uw.######

Additionally, confirm that certificate validity is not the actual cause:

• vCenter Certificates: Validate using the vCert tool to confirm certificates are in good standing.
  
  
• ESXi Host Certificates: Verify hosts are using sha256 via command-line:
     openssl x509 -in /etc/vmware/ssl/castore.pem -text -noout | grep "Signature Algorithm"
  
  
• Connectivity: Verify connectivity to port 2020 from the SDDC manager to vCenter:
      nc -zv VC_FQDN 2020

Environment

vCenter Server 8.0
SDDC Manager 5.2

Cause

This issue occurs because the Lifecycle Manager settingsd-task-forks resource pool on the ESXi host is exhausted. When the pre-check triggers the openssl command to validate the host certificate, the system cannot allocate enough memory to execute the command. This admission failure causes the task to return an error, which the vLCM incorrectly reports as a SHA-1 certificate issue.

Resolution

To resolve this issue, increase the memory limit for the settingsd-task-forks resource pool.

1. Log in to the ESXi host via SSH using root credentials.
2. Increase the memory allocation for the resource pool to 400 MB by running the following command: 
     localcli --plugin-dir=/usr/lib/vmware/esxcli/int sched group setmemconfig -g host/vim/vmvisor/settingsd-task-forks -m 400 -i 0 -l -1 -u mb
3. Re-run the compliance check in the vSphere Client.

Note: This issue is resolved in ESXi 8.0 Update 3g and later. If the issue persists, ensure the vCenter and ESXi host are on the latest patch release.

Additional Information

If the issue remains unresolved after increasing the memory limit, verify that there are no actual expired or SHA-1 certificates in /etc/vmware/ssl/ using the standard certificate verification procedures.

To review logs or troubleshoot further, see Creating and Managing Broadcom Support Cases. For further assistance, contact our support team at Contact Support.