Warning "Certificate Trust Check" seen in vSphere Diagnostics Tool after rotating vCenter Certificate from SDDC

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

After rotating vCenter Server certificates using the SDDC Manager, you may observe a warning in the vCenter Diagnostic Tool (VDT) regarding certificate trust:

[WARN]    Certificate Trust Check (TRUSTED|UNKNOWN-SIGNED)
                                Issuer Alias/Thumbprint: <thumbprint>
                                Issuer DN:C=<country>, ST=<state>, L=<locality>, O=<Organization>, OU=<Organization Unit>, CN=<Common Name>
                                Documentation:
                                        This signer isn't the current VMCA.
                                        If this is a custom cert, then it is missing the full chain in the VECS entry.
                                        Manually validate the certificate chain:
                                        https://knowledge.broadcom.com/external/article/369297

Environment

• SDDC 5.x
• vCenter Server 8.x

Cause

In case a vCenter Machine SSL certificate is renewed using the SDDC Manager UI, it is issued by the SDDC Manager's root certificate. Because the vSphere Diagnostic Tool (VDT) strictly compares the issuer against the vCenter's VMCA root certificate, it will flag this configuration with a "Certificate Trust Warning."

Resolution

This is expected as Machine SSL certificate on vCenter Server is issued by the root certificate of SDDC Manager.

If there is an environmental requirement to renew the vCenter Machine SSL certificate using VMCA root certificate, refer Steps to replace the MACHINE_SSL_CERT on vCenter Server using the default VMCA root certificate via the vSphere Client

Additional Information

• If Custom Certificates are configured, validate the certificate chain by following Manually validating custom certificate chain PEM file
• To manually validate Certificates in vCenter Server using CLI: 
  
  
  • Machine_SSL certificate:
    
    /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT --text | grep -E 'Issuer|Subject'

        Issuer: CN=SDDC_Manager.example.com, DC=vsphere, DC=local, C=US, ST=<state>, O=<Organization>, OU=<Organization Unit>
        Subject: CN=SDDC_Manager.example.com, C=<country>, ST=<state>, L=<locality>, O=<Organization>, OU=<Organization Unit>
         
  • All the other Solution User certificates are issued by VMCA root certificate. As an example, validate for Machine Solution User:
    
    /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE --text | grep -E 'Issuer|Subject'

 Issuer: Issuer DN:C=<country>, ST=<state>, L=<locality>, O=<Organization>, OU=<Organization Unit>, CN=CA
        Subject: CN=machine, DC=vsphere, DC=local, C=US, OU=mID-###########
                   CA Issuers - URI:https://vCenter.example.com/afd/vecs/ca