CA-Signed Certificate Replacement via vCert.py Fails with "Signing Chain in VMware Directory"

Products

VMware vCenter Server

Issue/Introduction

When attempting to replace a CA-signed endpoint certificate on vCenter Server (e.g., the Machine SSL certificate) using the vCert.py utility, the script halts during the cryptographic validation phase.
Running "Check current certificate status" (Option 1) or performing the replacement using vCert.py displays the following exact error message: One or more certificates do not have all of the CA certificates in its signing chain in VMware Directory
The CA-signed .pem file uploaded by the user is valid, and the chain is in the correct order (Server Certificate -> Intermediate CA -> Root CA). However, checking the live VECS store (/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT --text) or the local proxy file (/etc/vmware-vpx/ssl/rui.crt) shows only the leaf and intermediate certificates are present.
Additionally, the vecs-cli command does not list the target Root CA issuer in the TRUSTED_ROOTS store: /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store TRUSTED_ROOTS --text | grep -ie "Alias" -ie "Issuer" -ie "Not After".

Environment

VMware vCenter Server

Cause

The certificate replacement fails during the final cryptographic validation phase because the VMware Directory (VMDIR) lacks the necessary Root CA trust anchor.

Because the missing Root CA has not been explicitly pre-published to the VMware Directory's TRUSTED_ROOTS store, the validation engine cannot establish a verifiable path to a trusted root anchor. As a safety measure, the script halts and throws the signing chain error.

Resolution

To resolve this issue, publish the Root CA to the Trusted Roots store, then retry the certificate replacement.

Note: Take a snapshot of the vCenter VM before modifying or removing certificates and endpoints to prevent irreversible database corruption.

Step 1: Publish the Root CA to Trusted Roots Follow one of the methods below:

Via UI: Log in to the vSphere Client as Administrator. Navigate to Administration > Certificate Management > Trusted Root Certificates > Add. Browse to your custom .pem file and upload it. It should now list the Root CA.
Via CLI: Run ./vCert.py and select Option 4 (Manage SSL trust anchors). Select the sub-option to Add/Append a new trust anchor, and provide the path to your certificate file (ensure the combined .pem or .cer file includes the Leaf/Machine SSL, Intermediate, and Root certificates in a strict sequence: the Machine/Leaf Certificate at the top, followed by the Intermediate Certificate(s), and ending with the Root Certificate at the bottom).

Step 2: Finalize the Replacement

Re-run the ./vCert.py script and select Option 3 (Replace Machine SSL certificate) using your full-chain .pem file to successfully complete the certificate replacement.

Step 3: Remove Stale Lookup Service Endpoints

If the signing chain error persists after publishing the Root CA, unregister any stale or expired Lookup Service endpoints using the /usr/lib/vmidentity/tools/scripts/lstool.py unregister command, as these orphaned registrations often disrupt pre-flight trust validations during the certificate replacement process.