Broadcom's vcf-cert-tool (KB 445742) fixes expired internal certificates on vCenter, ESX, NSX, Supervisor, VCF Operations and Cloud Proxy from one menu-driven CLI. Supported versions, download and how to run it.
Supervisor control plane and spherelet certificates expire after one year. How to check them, rotate them from vCenter with Broadcom's certmgr tool, persist the new keys, and which certificates certmgr does not cover (KB 322994).
Which vCenter or VCF certificate is failing, and which tool fixes it: an alarm-to-fix map for vCenter 7, 8 and 9, vCert vs lsdoctor, and auto-renewal.
How a custom CA changes VCF 9 certificate operations: what Fleet Management auto-renews, what stays manual, and how new ESX hosts must be onboarded.
vCenter 8.0 U3h and VCF 9.0.2 renew VMCA Machine SSL and ESXi certificates automatically. What is covered, which thresholds apply, where vCert fits.
Renewed Machine SSL but port 3128 still shows an old cert? What vCert's LEGACY STS result means and how to move STS to MACHINE_SSL_CERT.
Why a vCenter certificate alarm can point to an old rollback copy in BACKUP_STORE or BACKUP_STORE_H5C, and how to verify and clear it with vCert.