Error: ESXi host certificate warning - Renewing with VMCA-signed certificate

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

ESXi hosts use certificates to encrypt traffic between the host and vCenter Server or client machines. vCenter Server triggers a proactive alert when these certificates are approaching their expiration date. This article provides steps to renew these certificates using the VMware Certificate Authority (VMCA).

• vCenter displays a warning: "Host certificate expiration is imminent."
• Attempts to upgrade from ESXi 7.x to 8.x fail due to SHA-1 certificate requirements.

Environment

• ESXi 7.x
• ESXi 8.x
• vCenter 7.x
• vCenter 8.x

Cause

ESXi host certificates have reached the end of their default validity period (typically 5 years) and require renewal to maintain secure communication and management plane stability.

Resolution

Log into the vSphere Client and navigate to the host whose certificate needs to be renewed. 

1. Click on the Configure tab
2. Under System, click Certificate.
3. Click MANAGE WITH VMCA
4. Click Renew
   
   
   

Additional Information

• The vCenter Server certificate management mode (vpxd.certmgmt.mode under Advanced vCenter Settings) must be set to vmca (the default). If it is set to custom, the Renew button will be greyed out.
  
  
• Certificates cannot be renewed beyond the expiration date of the root certificate. If the root is expiring soon, the host renewal will be truncated to that date.
•  

ESXi ホストの証明書を VMCA によって署名された証明書へ置き換える