vCenter Certificate Replacement Failed Private Key Not Found in VECS Store

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to replace certificates in VMware vCenter Server, the operation fails and the UI reports the following exact error message:

[CERTIFICATE] Replace cert Failed: Certificate not found for given ID (Private Key not found in VECS store)

This issue specifically occurs during the certificate replacement workflow when providing new certificates that do not align with the original request.

Environment

VMware vCenter Server 8.0.x

Cause

The certificate replacement operation fails due to a cryptographic key pair mismatch. The private key currently present in the VECS store does not match the uploaded certificate payload. This happens because self-signed certificates were utilized and uploaded instead of the Custom CA certificates that were originally tied to the generated Certificate Signing Request (CSR) and private key.

Resolution

 

1. Import the original Certificate Signing Request (CSR) and the corresponding private key back into the environment.

2. Send the original CSR to your Certificate Authority (CA) to authorize and generate a new full chain custom machine SSL certificate.

3. Take a snapshot of the vCenter Server Virtual Machine. Snapshot best practices for vCenter Server Virtual Machines.

4. Import the newly generated full chain Custom CA certificate back into the vCenter Server using the Certificate Management UI.

 

Additional Information

Renewing the vCenter certificate failed (KB 407840)

Certificate replacement failing in SDDC (KB 393693)