vCenter is down unable to access Web-UI, vmdir expired certificates

Products

• VMware vCenter Server

Issue/Introduction

Customer unable to access the Stand-alone vCenter Web-UI due to some services are not running upon rebooting the vCenter.

Environment

vCenter 7.x

vCenter 8.x

Cause

Expired certificates found on VMDir and it duplicates, Backup store VECS abd STS signing certs

Resolution

. Create a snapshot copy of the vCenter

b. Download and run vCert tool and will display Main Menu

c. On Main menu

To fix VMDir Certificates:

Choose option 3 - Manage certificates then option 3 again - CA certifcates in VMware directoryThis option prints information of the CA certificates in VMware Directory, and another sub-menu with options to publish or remove certificates to VMware Directory. Remove any duplicates or expired certificates from the lists.

To fix the BACKUP_STORE_entries

From Main Menu: Choose option 3 - Manage certificates > Choose 12 - Clear expired certificates in BACKUP_STORE in VECS

To fix VMDir expired

Reference KB https://knowledge.broadcom.com/external/article/405123/vcert-tool-reports-vmdir-certificate-exp.html 

Backup and Remove the Stale Certificate File

Navigate to the vmdir config directory
cd /usr/lib/vmware-vmdir/share/config

Create a backup of the existing file (optional)
cp vmdircert.pem vmdircert.pem.backup

Remove the stale certificate file
rm vmdircert.pem

After updating all expired certificates we restarted the vCenter services

Upon restart we manage to restore all the required vCenter services up and running again.

Access to both vCenter VAMI and it web-UI were restored.