How to Reset Expired SMS Self-Signed Certificate in vCenter Server Appliance

Products

• VMware vCenter Server

Issue/Introduction

In VMware vCenter Server Appliance (VCSA), the VMware Storage Provider Service (vmware-sps) may fail to start or report certificate authentication errors due to an expired SMS self-signed certificate stored in the VMware Endpoint Certificate Store (VECS).

Environment

VMware vCenter Server Appliance (VCSA)

Cause

The sms_self_signed certificate in the VECS sms store has expired, blocking communication for the Storage Provider Service (vmware-sps).

# for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; sudo /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done

STORE SMS
Alias : sms_self_signed
            Not After : May  3 06:21:09 2026 GMT

Resolution

1. Establish an SSH session to the vCenter Server Appliance as root.
2. Stop the Storage Provider Service:
   • # service-control --stop vmware-sps

3. Delete the expired sms_self_signed certificate entry from VECS:

   • # /usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store sms --alias sms_self_signed

4. Start the Storage Provider Service to auto-regenerate the SMS certificate:

   • # service-control --start vmware-sps