MACHINE_SSL_CERT certificate in VECS is about to expire Alarm in the vSphere Client UI

Products

• VMware vCenter Server

Issue/Introduction

An alarm in the vSphere Client UI shows that a certificate in the VMware Endpoint Certificate Store (VECS) and gives a KB link to follow.

Environment

VMware vCenter Server 8.x

Cause

This alarm is raised when there are certain number of days (customizable, but default is 30days) until the MACHINE_SSL_CERT certificate expires.

 

Resolution

• To replace the expiring Machine SSL Certificate using the vCenter Server UI, follow Steps to replace MACHINE_SSL_CERT on vCenter server using default VMCA root certificate on vCenter Server UI.
  
  
• Alternatively, use the vCert script to replace the MACHINE_SSL_CERT using vCert - Scripted vCenter expired certificate replacement.

Additional Information

Ensure that you have offline snapshots of the vCenter Server, and if applicable, all linked vCenter Server nodes before replacing certificates.

VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

vSphere Client UI における VECS 内の MACHINE_SSL_CERT 証明書期限切れ間近のアラーム