Certificate Lifecycle Management and Renewal Planning for VMware Cloud Foundation 5.x

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

This article serves as a central reference for planning and executing certificate renewals for VMware Cloud Foundation (VCF) 5.x environments. Use the procedures below to maintain certificate validity across all management and workload domain components, ensuring continued secure operations.

Environment

• VMware Cloud Foundation (VCF) 5.x
• Management and Workload Domains

Resolution

Planning Certificate Renewals:

1. Inventory Health Check: Ensure all infrastructure components (vCenter, NSX, VxRail, SDDC Manager) are healthy and reachable via the SDDC Manager dashboard.
2. Backups: Take verified file-level backups or offline (powered-off) snapshots of all infrastructure components before initiating any certificate generation or installation workflows.
3. Component-Specific Procedures: Use the following articles for component-specific renewal steps:
   • vCenter Server: Renewing self-signed certificates of vCenter via SDDC manager with Open SSL integration (416177)
   • NSX Manager: NSX Manager certificates replacement using SDDC Manager and VMCA in VCF 5.x (449294)
   • VxRail Manager: Renewing self-signed certificates for VxRail Manager via SDDC Manager (451991)
   • SDDC Manager: Revert SDDC Manager to using a self-signed certificate (451319)

Post-Renewal Validation:

1. Monitor task progress in the SDDC Manager Tasks panel until completion.
2. Verify the certificate status is marked as Valid in the SDDC Manager UI.
3. Run the SDDC Manager Supportability Tool (SoS) to confirm overall system health: /opt/vmware/sddc-support/sos --health-check