VMDir certificate expired warning in vCert tool for vCenter Server

Products

• VMware vCenter Server 8.0
• VMware vCenter Server

Issue/Introduction

• The vCert tool reports a VMDir certificate as expired when checking vCenter Server certificates.

• Trusted root certificates are not expired, and other services function without issues.

• The report shows "EXPIRED" for the VMDir certificate during the "Checking Certificate Status" operation in vCert as shown below:

Checking Certificate Status
------------------------------------------------------------------
Checking VMDir certificate                                 EXPIRED

• Log entries in /var/log/vmware/vCert/vCert.log in vCenter Server confirm this expiration.

YYYY-MM-DDTHH:MM:SS - [operation.check_certificate - check_file_system_certificate] - INFO - Checking certificate at /usr/lib/vmware-vmdir/share/config/vmdircert.pem

YYYY-MM-DDTHH:MM:SS - [operation.check_certificate - check_certificate_basic] - WARNING - Certificate is expired

Environment

• vCenter Server 7.x
  
  
• vCenter Server 8.x

Cause

• In vCenter Server 7.x and later, the VMDir certificate is deprecated and no longer used for system operations.
  
  
• Legacy certificate files, such as /usr/lib/vmware-vmdir/share/config/vmdircert.pem, remain on the system.
  
  
• The vCert tool monitors these files, resulting in a false expiration warning despite no impact on system functionality.

Resolution

Option 1: Backup and Remove the Stale Certificate File

1.  Navigate to the vmdir config directory
   
   cd /usr/lib/vmware-vmdir/share/config


2. Create a backup of the existing file (optional)
   
   cp vmdircert.pem vmdircert.pem.backup


3. Remove the stale certificate file
   
   rm vmdircert.pem


After removing the file, certificate expiration warnings for VMDir no longer appear in the vCert "Check current certificate status" report.

Option 2: Replace the VMdir Certificate with Machine SSL

Apply this alternative approach if file removal causes issues or if the vmdircert.pem file is missing.

1. Export the current Machine SSL certificate:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT > /tmp/machine_ssl.pem


2. Replace the VMdir certificate with Machine SSL:
   
   cp /tmp/machine_ssl.pem /usr/lib/vmware-vmdir/share/config/vmdircert.pem


3. Clean up the temporary file:
   
   rm /tmp/machine_ssl.pem


4. Restart vCenter Server services:
   
   service-control --stop --all && service-control --start --all


5. Re-run the script as detailed in vCert - Scripted vCenter Expired Certificate Replacement and verify that "Checking VMDir certificate" no longer displays in the "Checking Certificate Status" output.