vCenter Certificate Auto-Renewal: When You Still Need vCert

vCenter 8.0 U3h and VCF 9.0.2 renew VMCA Machine SSL and ESXi certificates automatically. What is covered, which thresholds apply, where vCert fits.

Short answer: Partly. From vCenter 8.0 Update 3h and VCF 9.0.2, vCenter renews VMCA-issued Machine SSL and ESXi host certificates automatically, but only when vpxd.certmgmt.mode is vmca, and only just before expiry: 5 days for Machine SSL, 10 days (configurable) for ESXi. Solution user, STS signing, externally issued and legacy-store certificates are not covered. You still need to know which mechanism owns each certificate, and keep vCert ready for recovery.

Part of the series “vCenter and VCF Certificate Management: Diagnosis, Renewal, and Operations”: this article is the entry point. Troubleshooting: STS_INTERNAL_SSL_CERT Explained: What vCert’s LEGACY Result Means and vCenter Certificate Alarm After Renewal? Check the Backup Stores. Fleet operations: VCF 9 Certificate Management: Custom CAs, Auto-Renewal, and Host Onboarding.

What changed in 8.0 U3h and VCF 9.0.2

Before vCenter 8.0 Update 3h, an expiring VMCA-issued Machine SSL certificate was an administrator task. If nobody acted, the certificate expired and services such as vpxd-svcs and sps stopped starting. Broadcom KB 396907 describes that failure and the manual fix with vCert.

The vCenter 8.0 U3h and VCF 9.0.2 release notes add native auto-renewal for two certificate types:

  • vCenter Machine SSL: extended by 2 years once fewer than 5 days remain.
  • ESXi host SSL: extended by 5 years once fewer than 10 days remain. This applies to hosts that support non-disruptive certificate renewal. The 8.0 U3h notes limit it to ESXi 8.0 Update 3 and later.

Both renewals apply only to certificates that VMCA issues. Both stop working if the vCenter advanced setting vpxd.certmgmt.mode is custom. KB 427937 adds that vCenter services are not restarted during the renewal.

Three renewal mechanisms, not one

“Auto-renewal” can mean three separate things, and they have different thresholds and eligibility rules. Before you trust any of them, check which one owns the certificate in front of you.

MechanismCoversWhen it renewsConditionSource
Native vCenter, Machine SSLvCenter Machine SSL certificate issued by VMCA5 days before expiry; fixed, not configurablevpxd.certmgmt.mode = vmca; vCenter 8.0 U3h+ or VCF 9.0.2+KB 427937, 8.0 U3h and 9.0.2 release notes
Native vCenter, ESXiESXi host certificates issued by VMCA10 days before expiry (8.0 U3h / 9.0.2); configurable via vpxd.certmgmt.certs.autoRenewThresholdvmca mode; host supports non-disruptive renewalKB 427937, release notes
VCF Operations Fleet ManagementVCF components with VMCA, Microsoft CA, OpenSSL or self-signed certificates that support non-disruptive updates60 days before expiryAuto-renewal toggle turned on per VCF Management or per VCF Instance; for Microsoft CA or OpenSSL, a CA configured firstKB 427937, VCF 9.0 TechDocs

One side effect is easy to miss. KB 427937 says that the first time you give an ESXi host a CA-signed certificate through Fleet Management, vCenter switches vpxd.certmgmt.mode to custom. After that, new hosts need a CA-signed certificate before you commission them, and the native vCenter renewal in the first two rows stops applying. Fleet Management and native renewal are alternatives, not layers. Article 4 of this series covers the Fleet Management side.

The ESXi threshold depends on version and source

Published values for the native ESXi renewal threshold differ:

SourceVersionESXi renewal threshold
vCenter 8.0 U3h release notesvCenter 8.0 U3hfewer than 10 days
VCF 9.0.2 vCenter release notesVCF 9.0.2fewer than 10 days
KB 427937vCenter 8.0 U3h, VCF/VVF 9.0.210 days, changeable with vpxd.certmgmt.certs.autoRenewThreshold
“What’s New with vSphere in VCF 9.1” (VMware blog, May 2026)vSphere in VCF 9.130 days, configurable with the same setting

The most likely explanation is that the default changed in 9.1, but I have not found release notes that state this directly. Don’t rely on either number. Check the value your vCenter actually uses:

  1. In the vSphere Client, select the vCenter Server and open Configure > Settings > Advanced Settings.
  2. Filter on vpxd.certmgmt.
  3. Check vpxd.certmgmt.mode. It must be vmca for native renewal.
  4. Check vpxd.certmgmt.certs.autoRenewThreshold (days). Broadcom does not say whether this key is listed when it has never been set. If it is missing, assume the documented default for your version.
  5. While you are there, note vpxd.certmgmt.certs.hardThreshold. TechDocs gives it a default of 30 days and describes it as the point where vCenter raises a red alarm.

Why the alarm fires before renewal is due

KB 427937 says the certificate pre-expiration alarm fires 30 days before expiry by default. KB 397104 ties the Certificate Status alarm to vpxd.cert.threshold and vpxd.certmgmt.certs.hardThreshold, both 30 by default. Native renewal does not start until 5 days (Machine SSL) or 10 days (ESXi, 8.0 U3h / 9.0.2) before expiry. That means a healthy, eligible certificate can keep a red alarm raised for about three weeks before renewal happens.

KB 427937 also says renewal follows the certificate’s expiration date, not the time the alarm fired. You have two options: renew early yourself, or confirm eligibility and let the alarm run its course. What you must not do is assume the alarm will clear on its own. It will not if the certificate is not eligible, for example a solution user certificate (KB 397104). It also will not clear if the certificate that triggers it lives in a store that renewal never touches. Article 3 covers the BACKUP_STORE case.

Where auto-renewal does not help, and vCert does

  • An expired Machine SSL certificate. If the vCenter is below 8.0 U3h, or the certificate already expired while in custom mode, KB 396907 still points to manual replacement with vCert (Manage certificates > Machine SSL certificate) followed by a restart of all services.
  • Solution user certificates. KB 397104 resolves expiring solution user certificates by replacing them, for example with vCert. Native renewal covers only Machine SSL and ESXi.
  • Legacy STS configuration. On vCenters upgraded from 6.x, the STS service can still use the old STS_INTERNAL_SSL_CERT store, and Machine SSL renewal never updates it. See article 1.
  • STS signing certificate. This is a separate certificate with its own failure pattern (“no healthy upstream”). See the STS signing certificate guide.
  • Externally issued certificates. The VCF 9.1 vSphere blog is explicit that certificates from an external CA are not auto-renewed natively. The administrator owns them, or Fleet Management does in VCF.
  • Trust problems and health checks. Stale trusted roots, mismatched trust anchors and certificates left in unused stores do not expire into an outage on a schedule, so no renewal job fixes them. A regular vCert health check (option 1) after each upgrade finds them. The vCert guide explains how to read the report.

The same blog notes that in 9.1 the VMCA root and its solution user certificates are renewed during a vCenter upgrade if the root expires in less than a year. Machine SSL and ESXi certificates are not renewed in that step.

A quick eligibility check

To see what is actually in VECS and when each entry expires, KB 396907 gives this loop. Run it on the vCenter appliance shell:

for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; sudo /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done

Illustrative output (placeholder dates, trimmed):

STORE MACHINE_SSL_CERT
Alias : __MACHINE_CERT
            Not After : <date within 30 days>   <- alarm raised; native renewal at 5 days if mode = vmca
STORE STS_INTERNAL_SSL_CERT
Alias : __MACHINE_CERT
            Not After : <date>                   <- legacy store; not touched by renewal (see article 1)
STORE BACKUP_STORE
Alias : bkp___MACHINE_CERT
            Not After : <past date>              <- old copy; see article 3

For each certificate that expires soon, answer three questions: who issued it (VMCA or external), which mechanism owns it (native, Fleet Management or nobody), and does that mechanism’s condition hold. If the answer to the second question is “nobody”, renew it yourself with vCert, or through Fleet Management in VCF.

So, can you stop renewing manually?

For VMCA-issued Machine SSL and ESXi certificates on a vCenter in vmca mode: mostly yes, provided you accept an alarm that fires weeks before the renewal. For everything else, including VCF components with a custom CA, solution users, STS and legacy stores: no. Those need an owner, a monitor and a tested recovery procedure.

Sources

Related on vdan.cz

Author: Daniel Micanek

Senior Service Architect, SAP/TDL Platform Services Team at Vivicta | vExpert ⭐⭐⭐⭐⭐⭐⭐ | Broadcom Knight: vSphere Kubernetes Service, VCF Networking (NSX), VCF Automation | Broadcom Software Knight: vSphere | Cisco Champion. Notes from running about 1,000 ESXi hosts on Cisco UCS, VCF 9 and SAP HANA on vSphere.