Error: SHA-1 signature found in host certificate False during ESXi 8.0 vLCM Compliance Check

Products

• VMware vSphere ESXi

Issue/Introduction

• When attempting to patch ESXi hosts using vSphere Lifecycle Manager, the compliance pre-check fails with the error: "SHA-1 signature found in host certificate False. Support for certificates with weak signature algorithm SHA-1 has been removed in ESXi 8.0." This article provides steps to resolve this false-positive error.

Environment

• vCenter Server 8.0.x
• ESXi 8.0.x
• Impacts Lifecycle Manager (vLCM) compliance scans.

Cause

This issue occurs because the Lifecycle Manager settingsd-task-forks resource pool on the ESXi host is exhausted. When the pre-check triggers the openssl command to validate the host certificate, the system cannot allocate enough memory to execute the command. This admission failure causes the task to return an error, which the vLCM incorrectly reports as a SHA-1 certificate issue.

Resolution

To resolve this issue, increase the memory limit for the settingsd-task-forks resource pool.

1. Log in to the ESXi host via SSH using root credentials.
2. Increase the memory allocation for the resource pool to 400 MB by running the following command: localcli --plugin-dir=/usr/lib/vmware/esxcli/int sched group setmemconfig -g host/vim/vmvisor/settingsd-task-forks -m 400 -i 0 -l -1 -u mb
3. Re-run the compliance check in the vSphere Client.

Note: This issue is resolved in ESXi 8.0 Update 3g and later. If the issue persists, ensure the vCenter and ESXi host are on the latest patch release.

Additional Information

If the issue remains unresolved after increasing the memory limit, verify that there are no actual expired or SHA-1 certificates in /etc/vmware/ssl/ using the standard certificate verification procedures.

To review logs or troubleshoot further, see Creating and Managing Broadcom Support Cases. For further assistance, contact our support team at Contact Support.