Delete an expired CSR from MACHINE_SSL_CERT VECS Store

Products

• VMware vCenter Server
• VMware Cloud Foundation

Issue/Introduction

• After using the vCenter UI to generate a new CSR for certificate renewal, the vCenter UI displays a "certificate status" alarm for expired/expiring CSR.
• VDT report shows expired CSR

Cause

When utilizing the vCenter UI to generate certificates, a CSR is generated and stored within the VECS store MACHINE_SSL_CERT by default. This generated CSR does not automatically get removed.

As designed, the Certificate Status alarm is then triggered approximately 60 or 90 days before the certificate expires, or when the certificate has fully expired as observed in any of the VECS stores.

Resolution

An expired CSR (__MACHINE_CSR) within the VECS store MACHINE_SSL_CERT can be safely ignored as it does not affect the function of vCenter.

However, should it be needed to remove the CSR to avoid triggering the Certificate Status alarm, follow the below steps.

1. SSH to the vCenter Server via root
2. List and review the current certificates within the VECS store:
   
   for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After"; echo "===================================================="; done;

Example Output Snippet
   

   [*] Store : MACHINE SSL CERT
   Alias : __MACHINE_CERT
                       Not After : [Date and Time]

   Alias : __MACHINE_CSR
                       Not After : [Expired Date and Time]

   Note: From the above output, we will see that the MACHINE_CSR has an already expired date.
   
   By default, all MACHINE_CSRs are stored within the MACHINE_SSL_CERT store. The CSRs are valid for only 1 day and will trigger the Certificate Status alarm the following day when they expire.
   
   
3. Remove the MACHINE_CSR certificate:
   
/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CSR

   Note: A restart of the vCenter Server services or a reboot is not required for the deletion to go into effect.
   

4. Within the vCenter UI, reset the Certificate Status alarm to green.

Additional Information

CertificateStatusAlarm - There are certificate that expired or about to expire/Certificate Status Change Alarm Triggered on VMware vCenter Server

The built-in alarm like Certificate Status can be edited to send mail. Edit the alarm under Alarm Definitions, click the Radial Button, select Edit, select Send mail, and add the desired mail/ distribution list. Follow the wizard to finish. Refer to Configure Mail Sender Settings for setting up the target mail server.