Custom Certificate on ESXi Host Reverts to VMCA Certificate and fails with error "A general system error occurred: Failed to verify certificate on <IP/Hostname>"
search cancel

Custom Certificate on ESXi Host Reverts to VMCA Certificate and fails with error "A general system error occurred: Failed to verify certificate on <IP/Hostname>"

book

Article ID: 454050

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

  • This article explains how to resolve an issue where custom certificates applied to an ESXi host are automatically removed or reverted to VMCA-signed certificates. This behavior occurs when vCenter cannot establish trust with the custom certificate.
  • When replacing the ESXi host certificate with custom certificate we hit the following error in the vSphere client:

"A general system error occurred: Failed to verify certificate on <IP/Hostname>. When ESXi Certificate Mode is set to custom it is mandatory to install valid certificate on ESXi host before adding the host to VC"

Environment

  • VMware vSphere ESXi 8.x
  • VMware vSphere ESXi 9.x
  • vCenter Server 8.x
  • vCenter Server 9.x

Cause

The custom certificate imported to the ESXi host is signed by a Certificate Authority (CA) that is not trusted by the vCenter Server. When the CA root or intermediate certificates are missing from the TRUSTED_ROOT store, vCenter reverts the host configuration to the default VMCA-signed certificate to maintain connectivity.

Resolution

To resolve this issue, ensure the root and intermediate certificates used to sign the ESXi host's custom certificate are present in the TRUSTED_ROOT store by following these steps:

  1. Export the root and intermediate certificates that sign the ESXi host's custom certificate.

  2. Add the exported certificates to the TRUSTED_ROOT store on the vCenter Server.

  3. Log in to the vSphere Client.

  4. Navigate to the vCenter Server and select the Configure tab.

  5. In the left pane, click Advanced Settings.

  6. Click Edit Settings at the top right corner, filter the list by vpxd.certmgmt.mode, change the value to custom, and click Save.

  7. Place the host where the certificate needs to be replaced in Maintenance Mode.

  8. Navigate to the ESXi host.

  9. Select the Certificates tab for the host.

  10. Click Import and Replace Certificate and complete the import process.

 

Note:

  • Disconnect the ESXi host from the vCenter Server if the certificate hasn't been replaced yet.
  • Reconnect the ESXi host to the vCenter Server.
Powered by Wolken Software