MACHINE_SSL_CERT certificate in VECS is about to expire Alarm in the vSphere Client UI

Products

• VMware vCenter Server

Issue/Introduction

An alarm in the vSphere Client UI shows that a certificate in the VMware Endpoint Certificate Store (VECS) and gives a KB link to follow.

Environment

VMware vCenter Server

Cause

This alarm is raised when there are certain number of days (customizable, but default is 30 days) remaining until the MACHINE_SSL_CERT certificate expires.

Resolution

• Use the vCert script to replace the MACHINE_SSL_CERT using vCert - Scripted vCenter expired certificate replacement.
• Alternatively, To replace the expiring self-signed Machine SSL Certificate, follow Steps to replace MACHINE_SSL_CERT on vCenter server using default VMCA root certificate on vCenter Server UI
• And to replace the custom certificate authority signed Machine SSL certificate, follow Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate or vCenter Machine SSL Certificate Replacement with Custom CA-Signed Certificate via vSphere Client UI
• Once you have the new Machine SSL certificates working on vCenter, you can reset the error message to green as it will not clear automatically with the new certificate.

Additional Information

This alarm may also be triggered when there is an expired MACHINE_SSL certificate in the BACKUP_STORE. 

So to clear the expired certificates from BACKUP_STORE, follow Certificate Status Alarm - Clearing BACKUP_STORES certificates in the VCSA

 

Ensure that you have offline snapshots of the vCenter Server, and if applicable, all linked vCenter Server nodes before replacing certificates.

Snapshot Best practices for vCenter Server Virtual Machines

VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

vSphere Client UI における VECS 内の MACHINE_SSL_CERT 証明書期限切れ間近のアラーム