In SDDC Manager, vCenter Upgrade Precheck fails with the error: "vCenter root account is locked or has expired"

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

In SDDC Manager, upgrade precheck fails when Performing vCenter root account lock check.

Fails with the error: vCenter root account is locked or has expired 

Environment

SDDC Manager 5.x

Cause

During an SSH handshake, the client (SDDC Manager) and the server (vCenter Server) agree on a host key algorithm to secure the session.
SDDC Manager by default uses the ECDSA and RSA algorithms.

If the vCenter Server SSH server configuration has been updated to support only ED25519, the SSH handshake between the SDDC Manager and vCenter Server will fail. 

For eg. The sshd_config file on the vCenter has been updated to allow only ED25519.

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

Resolution

Table of Contents

• Step 1: Validate that the vCenter root account has not expired and is not locked.
• Step 2: Validate ssh works from the SDDC Manager to the vCenter Server.
• Step 3: Restore to default configuration

 

Step 1: Validate that the vCenter root account has not expired and is not locked.

• SSH to the vCenter Server appliance and run the below command to check if the root account password has expired.
  

  > chage -l root
  Last password change                                    : Mar 31, 2026
  Password expires                                        : never
  Password inactive                                       : never
  Account expires                                         : never
  Minimum number of days between password change          : 90
  Maximum number of days between password change          : 90
  Number of days of warning before password expires       : 7
  

• Validate if the root account has been locked
  

  > faillock --user root
  Login           Failures    Latest failure         From
  root                0
  

• If the root account password has expired or is locked,
  
  • Reset the lock using the command: 

    faillock --user root --reset

  • Reset the root account password. See KB, vCenter Server Root Password Expiration Leading to account disconnect on SDDC Manager.
    
    
• Retry the pre-upgrade check. If the pre-upgrade check fails, go to step 2.

Step 2: Validate ssh connectivity from the SDDC Manager to the vCenter Server.

1. SSH to the SDDC Manager appliance and use the below command to ssh to the vCenter Server:
   

   ssh vcenter.example.com

2. If the below error occurs, ED25519 has ben configured manually on the vCenter Server.
   

   Unable to negotiate with ###.###.#.## port 22: no matching host key type found. Their offer: ssh-ed25519

Step 3: Restore to default configuration

1. Restore the sshd_config on the vCenter Server to defaults as below:
   

   #HostKey /etc/ssh/ssh_host_rsa_key
   #HostKey /etc/ssh/ssh_host_ecdsa_key
   #HostKey /etc/ssh/ssh_host_ed25519_key

2. Use the fixhosts.py script. See KB article, SSH connection fails with "reject HostKey" or "Primary psc init failed" errors