Month: May 2025

vCert (vCert.py) is Broadcom’s menu-driven script for checking and replacing vCenter Server certificates: Machine SSL, Solution Users, STS signing, trust anchors, VMCA and ESXi. The current build is vCert 6.1.2 (July 2026) and it supports vCenter 7.0, 8.0 and 9.x. Download it only from Broadcom KB 385107, snapshot vCenter first, and run it as root on the appliance. This guide maps each symptom to the right menu and explains the check results.

Not the vCert you were looking for? Venafi (now CyberArk) also ships a certificate CLI called VCert for enrolling TLS certificates from its platforms. It has nothing to do with vCenter. This page is about Broadcom’s vCert.py for vCenter and ESXi.

vCert at a glance

Current build	vCert-6.1.2-20260713.zip (always take the latest attachment from KB 385107)
Banner name	“VCF/VVF Certificate Management Utility (version 6.1.2)” (the tool’s own banner, as quoted in KB 385107)
Supported	vCenter Server Appliance 7.0.x, 8.0.x and 9.x
Download	Only from Broadcom KB 385107. Verify the SHA256 listed in the KB.
Runs on	The vCenter appliance shell, as root, from the extracted directory
Log	/var/log/vmware/vCert/vCert.log
Working files / backups	/root/vCert-master/YYYYMMDD/ (temporary files except backups are removed on exit)
Replaces	The Fixcerts script (KB 322249), which Broadcom has deprecated in favour of vCert

Before you run vCert

vCert changes certificates that every vCenter service depends on, so treat it like any other change to the SSO domain:

• Snapshot vCenter first. KB 385107 requires a snapshot of the vCenter Server VM before running the script. In Enhanced Linked Mode, back up all vCenter nodes in the SSO domain at the same point in time; a snapshot of one node is not a rollback plan for the domain. Follow the ELM notes in the KB.
• Have root on the appliance shell. vCert runs locally as root. If the root password has already expired, fix that first (see vCenter root password expired).
• Know your SSO administrator credentials. Most operations prompt for administrator@vsphere.local (or your SSO domain’s admin).
• Plan a service restart. Replacing Machine SSL, Solution User or STS certificates ends with a vCenter services restart, so the vSphere Client is unavailable for several minutes.

Download and install vCert 6.1.2

Download the zip from KB 385107 and copy it to the appliance, for example to /root. If WinSCP or scp can’t connect, set root’s login shell to bash first (chsh -s /bin/bash root). Then verify the hash, extract and start the tool:

# cd /root
# sha256sum vCert-6.1.2-20260713.zip      # compare with the SHA256 in KB 385107
# unzip -q vCert-6.1.2-20260713.zip
# cd vCert-6.1.2-20260713
# chmod +x vCert.py
# ./vCert.py

Always run vCert from the directory it was extracted to.

vCert versions and zip file names

KB 385107 hosts only the current build, and its SHA256 hashes are valid only for the current files. The file name carries the release date (YYYYMMDD). These are the builds people still search for:

File	Release date	Status
vCert-6.1.2-20260713.zip	13 July 2026	Current, attached to KB 385107
vCert-6.1.0-20250910.zip	10 September 2025	Superseded
vCert-6.0.1-20250516.zip	16 May 2025	Superseded
vCert-6.0.0-20250218.zip	18 February 2025	Superseded

If you have an older zip from a colleague or an old ticket, don’t run it. Download the current file from the KB, check its hash, and confirm the build with ./vCert.py --version.

Running vCert.py

./vCert.py [-h] [--version] [--env ENVIRONMENT] [--run OPERATION] [--user USER] [--password PASSWORD]

• --version prints the build you are running. Check it before you follow any guide, this one included.
• --env ENVIRONMENT loads an environment config file.
• --run OPERATION executes a single operation without the menu. The supported operation names for your build are listed by ./vCert.py --help.
• --user / --password provide SSO administrator credentials. Avoid --password on an interactive shell, because it ends up in shell history. Let vCert prompt for it, or use --env.

Launched interactively, vCert shows this menu:

 1. Check current certificate status
 2. View certificate info
 3. Manage certificates
 4. Manage SSL trust anchors
 5. Check configurations
 6. Reset all certificates with VMCA-signed certificates
 7. ESXi certificate operations
 8. Restart services
 9. Generate certificate report
 E. Exit

Logs and working files

• Log: /var/log/vmware/vCert/vCert.log
• Temp and backup files: /root/vCert-master/YYYYMMDD. Temporary files (except backups) are deleted on exit.

vCert.py errors when it won’t start

• SyntaxError: invalid syntax right after ./vCert.py, with a traceback into lib/vmdir.py or lib/menu.py: you are on vCenter 6.7 or older. vCert uses Python f-strings, and the Python on those appliances is older than 3.6. vCert supports vCenter 7.0 and later only (KB 418933). On 6.7, use the classic certificate-manager or upgrade first.
• Permission denied: run chmod +x vCert.py in the extracted directory.
• Missing modules or files: you started vCert.py from another directory. Change into the extracted vCert-x.y.z-YYYYMMDD directory first.
• Anything else: check /var/log/vmware/vCert/vCert.log and attach it to a support case.

Which vCert option fixes which problem

What you see	Start with	Fix with	Read more
vSphere Client shows no healthy upstream or login fails after a certificate expired	1 · Check current certificate status	3 · Manage certificates → Machine SSL / Solution Users, or 6 · Reset all with VMCA-signed certificates	STS signing certificate expiration
Alarm STS Signing Certificates are about to expire	2 · View certificate info → STS	3 · Manage certificates → STS signing certificates	Same article; KB 429527 covers an alarm that fires at 91 days
Plugin or solution registration errors after replacing Machine SSL; upgrade pre-checks complain about trust	4 · Manage SSL trust anchors (check)	4 · Update trust anchors across SSO nodes	lsdoctor for deeper Lookup Service repair
Certificate alarm caused by old BACKUP_STORE entries	1 · Check current certificate status	3 · Manage certificates → clear expired certificates	KB 326268
LDAPS identity source certificate expiring	2 · View certificate info	3 · Manage certificates → LDAPS Identity Source certificates	KB 371578
vmware-stsd uses a legacy store (STS_INTERNAL_SSL_CERT)	5 · Check configurations	Accept the prompt to switch STS to MACHINE_SSL_CERT	KB 423742 / KB 424604
ESXi host certificate expired, or hosts disconnect after a CA change	7 · ESXi certificate operations (check)	7 · Replace the host certificate, then reconnect the host	ESXi Host Certificate Status alarm
You need evidence before an upgrade or audit	9 · Generate certificate report	–	Report saved under /var/log/vmware/vCert

Menu options explained

1️⃣ Check Current Certificate Status

A comprehensive health check: expiry, SAN (Subject Alternative Name) presence, key usage, CA validity and signature algorithm, and Solution User to Service Principal consistency.

2️⃣ View Certificate Info

Readable details for Machine SSL and Solution User certificates, CA certificates (VECS and VMware Directory), and STS, SMS, Smart Card and LDAPS certificates.

3️⃣ Manage Certificates

Replace or modify Machine SSL, Solution User, CA certificates in VMware Directory and VECS, SMS, Data Encipherment, vCenter Extension thumbprints, STS signing, VMCA, Smart Card CA and LDAPS Identity Source certificates. The same submenu clears expired certificates (including old BACKUP_STORE entries) and CSRs. PEM/DER, PKCS#7 and PKCS#12 formats are supported.

💡 Certificate chains must be complete when importing custom CA-signed certificates.

4️⃣ Manage SSL Trust Anchors

Validates the trust anchors used by the Lookup Service and updates them across SSO domain nodes.

5️⃣ Check Configurations

SSL interception detection, STS store alignment (legacy vs MACHINE_SSL_CERT), and VECS store health and permission checks.

6️⃣ Reset All Certificates

Resets Machine SSL, Solution User and STS signing certificates, all signed by the VMCA.

7️⃣ ESXi Certificate Operations

Validates trust between vCenter and ESXi, checks database consistency, and replaces host certificates (rui.crt, rui.key, castore.pem). Requires a host service restart and reconnecting the host to vCenter.

8️⃣ Restart Services

Restarts all VMware services, or a specific service by name.

9️⃣ Generate Certificate Report

A detailed report of VECS entries, Service Principals, STS entries, Smart Card and LDAP certificates, and Lookup Service SSL anchors, saved under /var/log/vmware/vCert.

Reading vCert check results

vCert’s checks (options 1 and 5) flag more than expired certificates. These are the results people most often look up, what they mean, and whether to act:

• Checking VECS store configuration ... LEGACY / “The STS server is configured to use a VECS store other than the MACHINE_SSL_CERT store”. On vCenters upgraded from 6.x, vmware-stsd can still use the old STS_INTERNAL_SSL_CERT store. That store is not updated when Machine SSL is renewed, so it can expire silently. Act: let vCert update the STS configuration to MACHINE_SSL_CERT and restart the service (KB 423742, KB 424604).
• Checking Auto Deploy CA certificate ... NO SKID. /etc/vmware-rbd/ssl/rbd-ca.crt has no Subject Key Identifier. Act: nothing, unless you use vSphere Auto Deploy; if you do, replace it per KB 410906. Confirm with openssl x509 -in /etc/vmware-rbd/ssl/rbd-ca.crt -noout -text | grep -A1 "Subject Key Identifier".
• BACKUP_STORE entries nearing expiration. Copies of previously replaced certificates, kept for rollback. They are not in use but can raise certificate alarms. Act: clear them from option 3 (KB 326268, KB 445656).
• VMDir certificate marked EXPIRED. A legacy file left over from older releases and not used by 7.x/8.x. Act: no operational impact; removal is optional (KB 445656).
• “One or more VECS stores are missing permissions”. Option 5 checks VECS store permissions. If it reports missing permissions, let vCert fix them and restart the affected services.

KB 445656, which explains these anomalies, is written for vCenter 7.x and 8.x.

vCert and automatic certificate renewal

From vCenter 8.0 Update 3h and VCF 9.0.2, VMCA-issued Machine SSL and ESXi certificates are renewed automatically 5 days before they expire (KB 385107). This works only when the VMCA certificate mode (vpxd.certmgmt.mode) is set to vmca, not custom (KB 427937). That removes the most common outage, but not the need for vCert: STS signing, Solution User, trust-anchor and custom-CA certificates are not covered, and upgraded systems can still carry legacy stores. Run option 1 after every major upgrade.

Certificate series: which renewal mechanism owns which certificate, and where vCert still fits after 8.0 U3h and VCF 9.0.2, is covered in vCenter Certificate Auto-Renewal: When You Still Need vCert. The same series explains two vCert findings in detail: the STS_INTERNAL_SSL_CERT LEGACY result and expired BACKUP_STORE entries. VCF 9 fleets with a custom CA are covered in VCF 9 Certificate Management: Custom CAs, Auto-Renewal, and Host Onboarding.

vCert vs certificate-manager vs Fixcerts

Tool	Where	Use it for	Status
vCert.py	Download from KB 385107	Health checks, guided replacement of all vCenter certificate types, trust anchors, ESXi certificates, reports	Current, and Broadcom’s recommended tool
certificate-manager	/usr/lib/vmware-vmca/bin/certificate-manager (built in)	Classic replace/regenerate workflows (VMCA or custom CA) when you follow a specific KB	Still shipped; no health checks or trust-anchor repair
Fixcerts	KB 322249	–	Deprecated; use vCert instead

Related vCenter certificate guides

• vCenter STS signing certificate expiration: small certificate, big outage
• Using lsdoctor to repair the vCenter Lookup Service, and fixing lsdoctor’s IndexError on 8.0.3
• KB 406901: “Certificate authorities update failed” in the VCF 9 Management CA wizard
• VCF 9 upgrade: vRNI SSL thumbprint in SDDC Manager

Always snapshot before you change certificates, and re-run option 1 afterwards to confirm the result.