Security scan reports QID 38173 or 38685 on vSAN Witness appliance

Products

• VMware vSAN

Issue/Introduction

Security vulnerability scans from security scanners (e.g., Qualys, Nessus), frequently report QID 38173 (SSL Certificate - Signature Verification Failed) and QID 38685 (SSL Certificate - Invalid Maximum Validity Date Detected) on VMware vSAN Witness appliances.

These findings occur because default appliance configurations utilize the internal VMware Certificate Authority (VMCA), which is not recognized by external security scanners, and the default certificate validity may exceed standard requirements.

 

Symptoms:

• Security scanner reports QID 38173 (SSL Certificate - Signature Verification Failed).  Example: Title: SSL Certificate - Signature Verification Failed Vulnerability. Solution: Ensure the SSL certificate is valid and trusted. Install a certificate signed by a trusted Certificate Authority and configure the complete certificate chain, including any required intermediate certificates. Replace expired or invalid certificates and ensure proper issuer and signature configuration.
• Security scanner reports QID 38685 (SSL Certificate - Invalid Maximum Validity Date Detected). Example: Title: SSL Certificate - Invalid Maximum Validity Date Detected. Solution: Please install a server certificate with recommended maximum validity.(Please install a server certificate with recommended maximum validity.).
• vSAN Witness appliance uses the default self-signed certificate issued by VMCA.

Environment

• VMware vSAN Witness Appliance (all versions)
• VMware vSAN (all versions)
• VMware vSphere 7.x
• VMware vSphere 8.x
• External Vulnerability Scanner (e.g., Qualys, Nessus)

Cause

The vSAN Witness appliance is deployed with default certificates signed by an internal VMCA.

1. QID 38173: The scanner does not trust the internal VMCA root, causing signature verification failure.
2. QID 38685: The default certificate validity period often exceeds the industry-recommended 398 days.

Resolution

Replace the default self-signed certificates with custom certificates signed by a trusted Enterprise Certificate Authority (CA) to align with security compliance requirements.

1. Log in to the vSphere Client and navigate to the vSAN Witness host.
2. Generate a Certificate Signing Request (CSR) for the vSAN Witness host.
3. Submit the CSR to the internal Enterprise CA for signing. Ensure the requested validity period is 398 days or fewer.
4. Install the signed certificate on the vSAN Witness host using the vSphere Client.
5. Re-run the security scan to verify the resolution of the reported QIDs.

Additional Information

• For detailed steps on replacing ESXi host certificates, refer to Replacing ESXi Certificates (KB 440068).
• If security findings persist, Contact Broadcom Support for further analysis.
• For defects and enhancements, subscribe to the article (Reference 275360) to receive updates on fix status.