Short answer: vcf-cert-tool, the VCF Certificate Management Tool, is a menu-driven CLI from Broadcom (KB 445742). It checks and repairs expired or broken internal certificates on vCenter and ESX, NSX, the vSphere Supervisor (WCP), VCF Operations and the Cloud Proxy, all from one place. Until now you needed a different script for each component: vCert for vCenter, CARR for NSX, certmgr for the Supervisor. The new tool runs those component-level scripts for you. Download it from the Broadcom Support Portal under VMware Cloud Foundation 9 > Drivers & Tools. Take backups first, and use it as Broadcom Support directs.
On VCF 9.1, my VCF Certificate Tool navigator maps every vcf-cert-tool menu and recovery runbook for vCert, CARR, VCF Operations CASA, certmgr and Cloud Proxy.
Why a single certificate tool
An expired internal certificate rarely breaks only one product in VCF. A vCenter whose STS or Machine SSL certificate expired takes the Supervisor and VCF Operations collection down with it. Expired NSX certificates break the link to vCenter and the host transport nodes. Until now each fix needed its own tool, its own KB and its own login:
| Component | Tool you used until now | KB |
|---|---|---|
| vCenter and ESX | vCert (vCert.py, 6.1.2 at the time of writing) | 385107 |
| NSX | CARR (Certificate Analyzer, Results and Recovery) script | 369034 |
| vSphere Supervisor (WCP) | certmgr | 322994 |
| VCF Operations and Cloud Proxy | Appliance tools and the Fleet Management certificate pages | for example 320343 |
vcf-cert-tool brings these into one CLI. You choose the component from a menu, and the tool runs the native script for that component. You don’t have to keep track of which tool and version a given component needs.
Supported components and versions
| Component | Minimum version |
|---|---|
| vCenter Server and ESX | vSphere 8.0 Update 3 |
| vSphere Supervisor (WCP) | vSphere 8.0 Update 3 |
| NSX | 4.2.x |
| VCF Operations | 8.18.0 |
| Cloud Proxy | 8.18.0 |
That covers VCF 5.2 and VCF 9 environments. Older vCenter or NSX builds still need vCert or CARR on their own.
Download vcf-cert-tool
- Sign in to the Broadcom Support Portal and choose VMware Cloud Foundation in the division menu.
- Open My Downloads, search for VMware Cloud Foundation, and select VMware Cloud Foundation 9.
- Choose a release (for example 9.1.0.0) and open the Drivers & Tools tab.
- Find VCF certificate tool and download the newest entry. The download box stays grey until you accept both the Terms and Conditions and the Compliance Reporting Terms and Conditions.
You see the download only if your account has a VCF 9 entitlement. The tool still supports the older components in the table above.
Where and how to run it
You have two options:
- On a VCF appliance that meets the tool’s runtime requirements.
- From an operator workstation running Linux or macOS. The tool then connects to the components over SSH. This is handy when one of the appliances is the one that’s broken.
Copy the package to the host you’ll run it from and unpack it. The launch steps are in doc/quick_start.pdf and the full reference is in doc/user_guide.pdf, both inside the package. Read them for the release you downloaded, because the steps can change between versions.
Once it starts, the tool asks which component you want to work on: Cloud Proxy, NSX, VCF Operations, vSphere (vCenter) or WCP (Supervisor). Each option then offers the checks and fixes for that component. For vSphere, the tool runs vCert under the hood, so the vCert operations you know are still there.
Before you replace anything
- Back up everything first. Take a file-based backup of vCenter and NSX, offline snapshots of the vCenter nodes (all of them together if you use Enhanced Linked Mode), and a VCF Operations snapshot. Broadcom warns that a wrong change can leave a system inoperable.
- Use it with Broadcom Support. The KB says the tool is meant to be run as Global Support directs. On production, open a case first.
- Check trust afterwards. Replacing a certificate doesn’t update existing trust relationships on its own. Other VCF solutions registered with the component (for example VCF Operations, Live Recovery, Avi or a backup product) may need you to update or re-accept the certificate. Plan time to check each integration.
vcf-cert-tool or Fleet Management?
The two solve different problems. In VCF 9, day-to-day certificate work happens in VCF Operations under Fleet Management > Certificates: expiry alerts, CSRs, CA-signed replacement and auto-renewal (see VCF 9 certificate management with a custom CA). vcf-cert-tool is the repair tool for when that path no longer works, because an internal certificate already expired and the component won’t talk to VCF Operations or SDDC Manager. Prevention belongs in Fleet Management; recovery is where this tool comes in.
If you’re not sure which certificate is failing in the first place, start with my vCenter and VCF certificate troubleshooting map. For the most common vCenter case, see STS signing certificate expiration.
Further reading
- Broadcom KB 445742: VCF Certificate Management Tool (vcf-cert-tool) for handling expired certificates across VCF
- Broadcom KB 385107: vCert, scripted vCenter expired certificate replacement
- Broadcom KB 369034: CARR script for NSX certificate issues
- Replace vSphere Supervisor certificates with certmgr
