Automating vCenter certificate-manager CLI: Scripting Solution User Certificate Replacement (and When to Use vCert Instead)

Short answer: /usr/lib/vmware-vmca/bin/certificate-manager on the vCenter Server Appliance is interactive only; there is no documented non-interactive or answer-file mode. To automate it you either script the underlying tools it wraps (certool, vecs-cli, dir-cli, service-control) following the documented manual CLI procedure, or you use Broadcom’s newer vCert utility, which Broadcom now recommends over certificate-manager for most certificate workflows. Always snapshot vCenter first.

What certificate-manager is and where it lives

The vSphere Certificate Manager is a menu-driven shell utility on the VCSA. According to Broadcom KB 318946 it must be run as root and offers eight options:

Useful paths for troubleshooting and automation:

• Binary: /usr/lib/vmware-vmca/bin/certificate-manager
• Log: /var/log/vmware/vmcad/certificate-manager.log
• Certificate template used by certool: /usr/lib/vmware-vmca/share/config/certool.cfg

Why it cannot be automated directly

Every option prompts for the SSO administrator password, certificate attributes and confirmations. Wrapping it with expect works in a lab but is brittle: prompts change between builds, and a mismatched answer can leave vCenter half-updated. certificate-manager is essentially a front end for the VMCA and VECS command-line tools, and it records the commands it runs in certificate-manager.log. Running a workflow once interactively in a lab and reading that log is a good way to see exactly which calls you need to reproduce.

Scripting solution user certificate replacement with certool, vecs-cli and dir-cli

Broadcom documents the manual CLI equivalent of option 6 in Replace Solution User Certificates with New VMCA-Signed Certificates. The solution users are machine, vpxd, vpxd-extension, vsphere-webclient and wcp. Because the steps are identical per user, they loop cleanly:

#!/bin/bash
# Run as root on the VCSA after taking a snapshot.
# sol_usr.cfg = certool config with your Country/Org/Hostname values.
CERTOOL=/usr/lib/vmware-vmca/bin/certool
VECS=/usr/lib/vmware-vmafd/bin/vecs-cli
DIRCLI=/usr/lib/vmware-vmafd/bin/dir-cli

for SU in machine vpxd vpxd-extension vsphere-webclient wcp; do
  $CERTOOL --genkey --privkey=$SU-key.priv --pubkey=$SU-key.pub
  $CERTOOL --gencert --cert=new-$SU.crt --privkey=$SU-key.priv --Name=$SU --config sol_usr.cfg
  $VECS entry delete --store $SU --alias $SU
  $VECS entry create --store $SU --alias $SU --cert new-$SU.crt --key $SU-key.priv
done

# Map each solution user to its unique service ID in VMware Directory:
$DIRCLI service list
# then for each one, e.g.:
# $DIRCLI service update --name vpxd-<ID> --cert new-vpxd.crt

service-control --stop --all && service-control --start --all

Notes: vecs-cli entry delete asks for confirmation unless you answer it (-y); dir-cli prompts for SSO credentials unless you pass --login and --password. Keep the password out of shell history, for example by reading it from a protected file. Replacing solution user certificates is rarely required: VMware’s guidance has long been to leave them VMCA-signed and replace only the Machine SSL certificate.

certificate-manager vs vCert: which one to use

vCert (KB 385107) is a Python-based tool from Broadcom support for vCenter 7.0, 8.0 and 9.x. KB 313947 now presents vCert as the primary method for solution user replacement and lists certificate-manager as the deprecated method.

My rule of thumb: use vCert for checks, reports and recovery; use the raw certool/vecs-cli/dir-cli sequence only when you need a fully scripted, repeatable change in a pipeline. Installation and menu walkthrough are in Installing and using the vCert tool. If vCenter already shows “no healthy upstream” because the STS signing certificate expired, start with this STS certificate guide.

Before you run anything

1. Take a snapshot of vCenter; for Enhanced Linked Mode, take powered-off snapshots of all linked vCenters at the same time (KB 318946).
2. Confirm the hostname matches the FQDN in the certificate config, otherwise replacement does not complete correctly.
3. Expect connected products (NSX, backup, SRM, VCF Operations) to need re-registration or trust updates.

Further reading

• William Lam: Automating certificate-manager CLI operations in vCenter Server (VCSA)
• KB 318946: Using vSphere Certificate Manager to replace SSL certificates
• KB 385107: vCert, scripted vCenter expired certificate replacement
• KB 313947: Replace vCenter Solution User certificates with VMCA-issued certificates