vCert Fails to Replace vCenter STS Certificate with LDAP_ALREADY_EXISTS 68

Products

• VMware vCenter Server

Issue/Introduction

When selecting the option to replace the Security Token Service (STS) certificate in vCenter, the vCert script fails with the following exact error message: lib.exceptions.Ldapexception: ldap exception error code 68 (entryAlreadyexsists)

Checking the vmdird log at /var/log/vmware/vmdird/vmdird.log displays the following symptoms and errors indicating an existing key entry: 2026-07-07T16:46:26.2912:t@140478422926912:ERROR: vmDirSendLdapResult: Request (Add), Error (LDAP_ALREADY_EXISTS(68)), Message (BLEntryAdd (9706)((MDB_KEYEXIST: Key/data pair already exists)(cn=trustedcertchain-1,cn=trustedcertificatechains,cn=vsphere.local,cn=tenants,cn=identitymanager,cn=services,dc=vsphere,dc=local))), (0) socket (<127.0.0.1>)

Environment

vCenter Server 8

Cause

This issue occurs on certain legacy vCenter Server configurations where the vCert utility does not fully delete the old STS certificate before attempting to create a new one.

Resolution

• Snapshot vCenter

• Connect to the vCenter Server Appliance via SSH and log in as root.

• Manually delete the old STS certificate first before using vCert by executing the following command: /opt/likewise/bin/ldapdelete -D "cn=Administrator,cn=Users,dc=vsphere,dc=local" -W "cn=TrustedCertChain-1,cn=TrustedCertificateChains,cn=vsphere.local,cn=Tenants,cn=IdentityManager,cn=Services,dc=vsphere,dc=local"

• Once the manual deletion is successful, run the vCert utility again to replace the STS certificate.