ESX hosts reporting evaluation license expired, while Hosts are listed as licensed by VCF Operations

Products

• VMware vSphere ESXi

Issue/Introduction

ESXi hosts report an expired evaluation license in the UI and command line, preventing VM operations such as power-on or migration, even though VCF Operations and vCenter report the hosts as correctly licensed. Only ESX UI and Command line show that the license has expired, vCenter and VCF Ops report no issues


# vim-cmd vimsvc/license --show
[200] Sending request for installed licenses...[200] Complete, result is:
   serial: 00000-00000-00000-00000-00000
   vmodl key: esx.eval.entitlement.cpuCoreMin
   name: VMware ESX Server
   total: 1
   used: 1
   unit: host
   Properties:
     [system_time] = <Current date>
     [startDate] = <Evaluation License start date>
     [expirationDate] = <Evaluation License stop date>
     [expirationHours] = 0
     [expirationMinutes] = 0
     [diagnostic] = Evaluation period has expired, please install license.
     [ProductName] = VMware ESX Server
     [ComponentFamily] = VMware ESX Server
     [ProductVersion] = 9.0
     [FileVersion] = 9.0.0.1
     [Localized] = <Not supported type for value: [N5Vmomi9DataArrayINS_11KeyAnyValueEEE]>

Environment

VMware Cloud Foundation (VCF) 9.x VMware vSphere ESXi 9.x

Cause

The vpxd.certmgmt.mode advanced parameter is set to thumbprint.
Thumbprint mode is only for troubleshooting purposes and should not be used in production 
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/9-0/vsphere-security/securing-esxi-hosts/certificate-management-for-esxi-hosts/change-the-certificate-mode.html 

Resolution

Certificate more is set to thumbprint, so vCenter can't assign the License to the Hosts, to address the issue follow these steps:

1. Backup Host certificates
   # cd /etc/vmware/ssl
# mv rui.crt rui.crt.bkp
# mv rui.key rui.key.bkp
2. Regenerating Self-Signed Certificates on Standalone ESXi Hosts
   # /sbin/generate-certificates
   # /etc/init.d/hostd restart && /etc/init.d/vpxa restart
   
   
3. Switch Certificate mode, in vCenter to VMCA
   
   
4. Reconnect Hosts to vCenter
   
   
5. Hosts should be licensed now, and they should receive VMCA signed certificates
   
   
6. In case you want to reuse the CA signed Host certificates, please pursue the following documentation Configuring CA signed certificates for ESXi hosts
   
   

Additional Information

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/9-0/vsphere-security/securing-esxi-hosts/certificate-management-for-esxi-hosts/change-the-certificate-mode.html 

Thumbprint certificate Mode is only to be used for troubleshooting purposes, it's not recommended for Production