Short answer: start by identifying the certificate, not the tool. Run the VECS expiry check below or a vCert health check (option 1), then match the alarm or error to the table on this page. vCert fixes most vCenter certificate problems: Machine SSL, solution users, STS signing, trust anchors and ESXi. lsdoctor fixes the Lookup Service registrations that point at them. From vCenter 8.0 U3h and VCF 9.0.2, VMCA-issued Machine SSL and ESXi certificates renew themselves, but only in vmca mode and only a few days before expiry.
This page is the index for every certificate article on vDan. Each link says when to read it.
First check: which certificate is expiring?
Most vCenter certificates live in VECS, the VMware Endpoint Certificate Store. This loop from Broadcom KB 396907 prints every store with the alias and expiry date of each entry. Run it as root in the vCenter appliance shell:
for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; sudo /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; doneThe store name tells you which certificate you are dealing with:
| Store or certificate | What uses it | Read |
|---|---|---|
MACHINE_SSL_CERT | The vCenter endpoint certificate that browsers and API clients see | Auto-renewal: when you still need vCert |
Solution users (machine, vsphere-webclient, vpxd, vpxd-extension, wcp, hvc) | Internal service-to-service authentication | vCert guide · certificate-manager scripting |
| STS signing certificate (not a VECS store; check it with vCert) | Signs every vCenter SSO token | STS signing certificate guide |
STS_INTERNAL_SSL_CERT | Legacy STS store on vCenters upgraded from 6.x | STS_INTERNAL_SSL_CERT and vCert’s LEGACY result |
BACKUP_STORE, BACKUP_STORE_H5C | Rollback copies of replaced certificates | Certificate alarm after renewal: check the backup stores |
TRUSTED_ROOTS | CA certificates that vCenter trusts | vCert guide (trusted root options) |
| ESXi host certificate (stored on the host, tracked by vCenter) | Host management endpoint | ESXi Host Certificate Status alarm |
Alarm or error → fix
Find the message you see and go straight to the fix.
| You see | Likely cause | Read |
|---|---|---|
| “STS Signing Certificates are about to expire”, or “no healthy upstream” at login | STS signing certificate within 90 days of expiry, or already expired | STS signing certificate guide |
| “ESXi Host Certificate Status” alarm | A host certificate expires within about 30 days | ESXi Host Certificate Status: Renew, VMCA mode, vCert |
| A Certificate Status alarm that stays raised after you renewed | An old copy in a backup store, or a certificate that renewal doesn’t cover | Check the backup stores · What auto-renewal covers |
vCert reports STS as LEGACY; an old certificate still shows after a Machine SSL renewal | STS still uses the pre-7.0 STS_INTERNAL_SSL_CERT store | STS_INTERNAL_SSL_CERT explained |
| “HTTP Status 500 – Internal Server Error” at the vSphere Client login | Expired certificates, a corrupted STS cache after patching, or broken SSO registrations | HTTP 500: causes and fixes |
| Lookup Service errors, SSL trust mismatch in service registrations | Registrations still point at an old certificate | lsdoctor guide |
| lsdoctor fails with an IndexError on vCenter 8.0.3.00000 | A customised login banner | lsdoctor on 8.0.3.00000 |
VCF 9.0 “Certificate authorities update failed” (401 in vmware_vrlcm.log) | # or & in the Microsoft CA service account password (KB 406901) | KB 406901 fix |
| VCF 9 upgrade stops at the vRNI / Aria Operations for Networks SSL thumbprint check | SDDC Manager stores the thumbprint of a replaced certificate | vRNI SSL thumbprint fix |
| vROps / Aria Operations: “Data Retriever is not initialized yet” | Expired internal certificate (KB 71018) | Replace the vROps internal certificate |
| VAMI: “Exception in invoking authentication handler User password expired” | Not a certificate: the appliance root password expired | vCenter password expired |
Tools: vCert, lsdoctor and certificate-manager
| Tool | Use it for | Where to get it | Guide |
|---|---|---|---|
vCert (vCert.py) | Checking and replacing vCenter certificates: Machine SSL, solution users, STS signing, trust anchors, VMCA and ESXi. Supports vCenter 7.0, 8.0 and 9.x. | Broadcom KB 385107 | vCert guide |
lsdoctor (lsdoctor.py) | Checking and repairing Lookup Service registrations, SSL trust and solution users. Start with the read-only --lscheck. | Broadcom KB 320837 | lsdoctor guide |
certificate-manager | The older built-in, interactive-only menu. Broadcom now recommends vCert for most certificate workflows. | On the appliance: /usr/lib/vmware-vmca/bin/certificate-manager | Scripting certificate-manager, and when to use vCert instead |
A rule that saves time: vCert changes certificates, lsdoctor fixes what points at them. If you replace a certificate and services then fail to register or trust each other, that is lsdoctor territory. Take an offline snapshot of every vCenter in the SSO domain before running either tool.
Auto-renewal in vCenter 8.0 U3h and VCF 9.0.2
Per Broadcom KB 427937, vCenter 8.0 U3h and VCF 9.0.2 renew two certificate types natively:
- VMCA-issued Machine SSL, 5 days before expiry;
- VMCA-issued ESXi host certificates, 10 days before expiry by default (configurable).
Both require vpxd.certmgmt.mode = vmca. The certificate alarm fires at 30 days, so a certificate that will renew itself can still show a red alarm for about three weeks. Solution user, STS signing, externally issued and legacy-store certificates are not covered. vCenter Certificate Auto-Renewal: When You Still Need vCert has the full table, including the 9.1 threshold change.
VCF 9: fleet certificates and custom CAs
In VCF 9, VCF Operations Fleet Management can renew certificates for VCF components, including ones from a Microsoft CA or OpenSSL. It isn’t a layer on top of the native vCenter renewal; it replaces it. Giving an ESXi host a CA-signed certificate through Fleet Management switches vCenter to custom mode, and new hosts then need a CA-signed certificate before you commission them.
- Planning a custom CA or onboarding hosts: VCF 9 Certificate Management: Custom CAs, Auto-Renewal, and Host Onboarding
- The Management CA wizard fails: KB 406901
- SSO with an external identity provider and its certificate chain: VCF 9.0 SSO with Keycloak · HTTPS for the Keycloak or Authentik OIDC endpoint
Upgrade-time certificate traps
- vCenters upgraded from 6.x can keep STS on the legacy store, so a Machine SSL renewal never reaches it. Check with vCert before the next upgrade.
- HTTP 500 right after patching is often a corrupted STS Tomcat cache, not an expired certificate. Clear the cache.
- VCF upgrade pre-checks compare stored thumbprints. After you replace a component certificate, SDDC Manager can still hold the old one. vRNI example.
- Run a vCert health check after every upgrade. Stale trusted roots and mismatched trust anchors don’t expire into an outage on a schedule, so no renewal job finds them.
Other products and related certificates
- VMware Identity Manager (vIDM): replace its certificate from Aria Suite Lifecycle 8.x.
- vROps / Aria Operations: expired internal certificate (KB 71018).
- Microsoft Secure Boot certificates in VMs: a guest-side expiry in 2026, not a vCenter certificate. See KB 423893: what to do in 2026.
Sources
- KB 385107: vCert – Scripted vCenter expired certificate replacement
- KB 320837: Using the lsdoctor tool
- KB 396907: Machine SSL certificate replacement and auto-renewal in vCenter Server 8.x
- KB 427937: SSL certificate auto-renew for Machine SSL and ESXi
- KB 406901: Configure Certificate Authority for VCF Management fails with “Certificate authorities update failed”
