Error: MACHINE_SSL_CERT certificate in VECS is about to expire alarm in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

The vSphere Client UI triggers a proactive alarm when a certificate in the VMware Endpoint Certificate Store (VECS) approaches its expiration date. This can lead to connectivity failures with external services, such as Veeam backup software, resulting in "remote certificate was rejected" errors.

• Alarm "MACHINE_SSL_CERT certificate in VECS is about to expire" is active in the vSphere Client.
• External backup or monitoring tools fail to authenticate.
• Logs indicate SSL handshake failures or rejected certificates.

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

The vCenter Server monitors certificates in VECS and triggers a warning alarm by default 30 days prior to expiration. The MACHINE_SSL_CERT is used for secure communication; once it enters the expiration window, some external agents may treat the connection as untrusted.

Resolution

1. Create a powered-off (offline) snapshot of the vCenter Server Appliance.
2. Use the vCert script to replace the MACHINE_SSL_CERT using vCert - Scripted vCenter expired certificate replacement.
3. Alternatively, To replace the expiring self-signed Machine SSL Certificate, follow Steps to replace MACHINE_SSL_CERT on vCenter server using default VMCA root certificate on vCenter Server UI
4. And to replace the custom certificate authority signed Machine SSL certificate, follow Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate or vCenter Machine SSL Certificate Replacement with Custom CA-Signed Certificate via vSphere Client UI
5. Once you have the new Machine SSL certificates working on vCenter, you can reset the error message to green as it will not clear automatically with the new certificate.

Additional Information

This alarm may also be triggered when there is an expired MACHINE_SSL certificate in the BACKUP_STORE. 

So to clear the expired certificates from BACKUP_STORE, follow Certificate Status Alarm - Clearing BACKUP_STORES certificates in the VCSA

Ensure that you have offline snapshots of the vCenter Server, and if applicable, all linked vCenter Server nodes before replacing certificates.

Snapshot Best practices for vCenter Server Virtual Machines

VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

vSphere Client UI における VECS 内の MACHINE_SSL_CERT 証明書期限切れ間近のアラーム