vCenter Server Port 3128 Presents Expired Certificate After Machine SSL Certificate Update

Products

• VMware vCenter Server

Issue/Introduction

Vulnerability scanning software may flag expired SSL certificates on vCenter Server appliances even after the Machine SSL certificate has been successfully updated.
Specifically, the smart card authorization service (port 3128) continues to present the previous, expired certificate rather than the newly provisioned certificate.

Running the following command on the vCenter appliance confirms a expired certificate is associated with the port:

openssl s_client -connect localhost:<port number> -servername <vcenter_fqdn> 2>/dev/null | openssl x509 -noout -dates

 

Environment

VMware vCenter Server 8.x / 9.x

Cause

The vCenter Server appliance services utilize cached configuration data in memory.
If the appliance services are not restarted following a certificate update, the services bound to specific ports, such as 3128, continue to utilize the expired certificate files stored in the memory process rather than the updated certificate files present on the disk.

Resolution

Ensure the vCenter Server is restarted after updating any certificates in the environment. 

Method 1: Using the vCenter Server Management Interface

1. Log in to the vCenter Server Management Interface (VAMI) at https://<vcenter_fqdn>:5480.
2. Navigate to the Summary tab.
3. Click the Actions drop-down menu in the top pane.
4. Select Reboot to restart the virtual machine.
5. Click Yes in the confirmation dialog box.

Method 2: Using the Command Line Interface (Recommended for Targeted Restart)

1. Access the vCenter Server Appliance via SSH as root.
2. Execute the following command to stop and restart all vCenter services:
   

   service-control --stop --all && service-control --start --all

   
   
    

Verification After the services have successfully restarted, verify that the port is presenting the updated, valid certificate by running the following OpenSSL command:

openssl s_client -connect localhost:<port number> -servername <vcenter_fqdn> 2>/dev/null | openssl x509 -noout -dates

 

If the certificate is still showing expired, please reach out to Broadcom Support for additional assistance - Contact Support - Broadcom Software

Additional Information

Reference: vSphere Security Certificates