"Signed certificate could not be retrieved due to a start time error" when adding an ESXi host to vCenter Server

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

After replacing the VMware Certificate Authority (VMCA) root certificate with an enterprise subordinate certificate, the following symptoms may occur:

• An ESXi host is unable to connect to the vCenter Server, or all hosts show as disconnected.
• Unable to renew certificate on an ESXi host managed by the vCenter Server.
• The following error message appears:
  A general system error occurred: Unable to get signed certificate for host: . Error: Start Time Error (70034)

Environment

• vCenter Server 8.x
• vCenter Server 7.x
• vSphere ESXi 8.x
• vSphere ESXi 7.x 

Cause

When adding an ESXi host to the vCenter Server, the VMware Certificate Authority pre-dates ESXi certificates by 24 hours to avoid time synchronization issues. This is managed by the vpxd.certmgmt.certs.minutesBefore advanced setting in the vCenter Server. Due to this, VMCA is unable to renew certificates on any ESXi hosts managed by the vCenter Server.

Resolution

To change the vpxd.certmgmt.certs.minutesBefore setting from 24 hours to 10 minutes, follow these steps:

• Log in to the vCenter Server via the vSphere Client using your administrator credentials.
• Select the vCenter object from inventry and navigate to the Configure tab.
• In the settings list, select Advanced Settings, and then click Edit Settings.
• In the Name field, enter the following key: vpxd.certmgmt.certs.minutesBefore
• In the Value field, change the value from 1440 to 10.
• Click Save.

To work around this issue without changing the advanced settings:
Wait 24 hours after replacing the VMware Certificate Authority (VMCA) certificate with an enterprise subordinate certificate before attempting to add additional hosts to the vCenter Server or renewing certificates on the ESXi host.