ESXi Host Certificate Status shows Expiration imminent

Problem

vCenter Server raises the alarm:

ESXi Host Certificate Status

and the host certificate page reports:

Status: Expiration imminent

The ESXi host may still be connected and all running virtual machines may continue operating normally.

This alert is normally raised before the certificate actually expires, giving administrators time to renew it before management connectivity is affected.

Environment / scope

This procedure applies to ESXi hosts managed by vCenter Server when the host certificate is signed by the VMware Certificate Authority (VMCA).

The workflow was validated in a production vSphere 7.x environment. All addresses, hostnames, domains and dates shown below are sanitized examples.

Expected behaviour

A healthy ESXi host certificate should:

• Be within its validity period
• Chain to a valid trusted CA
• Display a healthy certificate state in vCenter
• Have sufficient remaining validity to avoid certificate expiration alarms

Broadcom documents that vCenter typically raises the ESXi host certificate alarm around 30 days before expiry.

Observed behaviour

Example:

Subject: CN=esxi01.lab.example.com
Issuer: VMCA
Valid from: 2021-10-19
Valid to:   2026-10-19
Status: Expiration imminent

The host remains connected, but vCenter displays a red or warning-level certificate alarm.

Root cause

The host certificate is close to its expiration date.

When the ESXi host is using a VMCA-signed certificate, the normal corrective action is to have vCenter request and install a new host certificate from VMCA.

Before renewing it, verify that the VMCA Root certificate itself is still valid. A leaf certificate cannot be issued with a validity period beyond the expiration date of the CA that signs it.

Diagnostic workflow

1. Check the ESXi host certificate

In the vSphere Client:

Hosts and Clusters
  -> Select the ESXi host
  -> Configure
  -> System
  -> Certificate

Check:

• Subject
• Issuer
• Valid from
• Valid to
• Status

If the status is Expiration imminent, compare the current date with Valid to.

2. Confirm the certificate is VMCA-signed

Review the Issuer field.

In a default VMCA-managed environment, the issuer normally identifies the vCenter/VMCA certificate authority.

If the environment uses custom CA-signed host certificates, do not assume the VMCA renewal workflow applies. Follow the certificate process for the configured CA.

3. Verify the VMCA Root certificate

Before renewing the ESXi host certificate, go to:

vCenter
  -> Administration
  -> Certificate Management
  -> Trusted Root Certificates

Open the VMCA Root certificate and verify:

• Status is valid
• Valid until is comfortably in the future

Example:

VMCA Root
Status: Valid
Valid until: 2035-12-05

If the VMCA Root is itself close to expiration, renew or replace the root certificate first. Otherwise a newly issued host certificate may inherit a shortened validity period and the alarm may remain.

4. Check basic prerequisites

Before renewal, confirm:

• The ESXi host is connected to vCenter
• DNS resolution between vCenter and the host is working
• Time synchronization is correct
• The vCenter Machine SSL certificate is valid
• On older releases, the host is not in maintenance mode during the renewal operation

Resolution

1. Renew the host certificate

For vCenter releases prior to 8.0 Update 3:

Host
  -> Configure
  -> System
  -> Certificate
  -> Renew

Confirm the operation.

For newer releases where the UI uses the VMCA management workflow:

Host
  -> Configure
  -> System
  -> Certificate
  -> Manage with VMCA
  -> Renew

vCenter requests a newly generated host certificate signed by VMCA and pushes it to the ESXi host.

Renew vs Refresh CA Certificates

These actions are not equivalent.

Renew

• Generates a new ESXi host certificate
• Signs it with VMCA
• Pushes the new host certificate to ESXi
• Also refreshes the relevant VMCA CA certificates

Refresh CA Certificates

• Pushes the VMCA CA/root certificates to the host
• Does not, by itself, replace the ESXi host certificate

For an Expiration imminent host certificate, use Renew.

Operational impact

Broadcom documents that no service disruption is normally expected from renewing the host certificate through vCenter.

Running virtual machines are not powered off by this operation.

However, because certificate renewal affects the ESXi management plane and trust relationship with vCenter, perform the change during a controlled maintenance window when practical.

Validation

After the renewal completes, return to:

Host
  -> Configure
  -> System
  -> Certificate

Confirm that:

• Valid from reflects the newly issued certificate
• Valid to has moved to a future date
• Status is no longer Expiration imminent
• The host remains connected to vCenter

Then verify the alarm on the host summary page.

If necessary, acknowledge or reset the alarm after the certificate state is healthy.

If the alarm remains after renewal

If the renewal task succeeds but the new certificate still expires soon, check the VMCA Root certificate again.

A common cause is an expiring VMCA Root. The ESXi certificate cannot remain valid beyond the CA that signs it.

If the VMCA Root is near expiry:

1. Protect the vCenter with the vendor-recommended backup/snapshot procedure.
2. Replace or renew the VMCA Root using the supported Broadcom certificate tooling.
3. Renew the ESXi host certificate again.
4. Verify the new expiration date.

Do not repeatedly renew the host certificate without checking the issuing CA.

Optional CLI validation

If SSH is enabled on the ESXi host, the current certificate can be inspected without making changes:

openssl x509 -in /etc/vmware/ssl/rui.crt -noout -subject -issuer -dates -serial

Example output:

subject=CN = esxi01.lab.example.com
issuer=CN = lab-vmca
notBefore=Sep 22 15:00:00 2026 GMT
notAfter=Sep 22 15:00:00 2031 GMT
serial=...

This is a read-only validation command.

Prevention / best practice

• Monitor vCenter certificate alarms instead of waiting for certificates to expire
• Periodically review ESXi host certificate validity
• Review the VMCA Root validity before large certificate-renewal campaigns
• Maintain working DNS and NTP between vCenter and ESXi hosts
• Document whether the environment uses VMCA or custom host certificates
• Validate the new Valid to date immediately after renewal
• Use Renew for an expiring host certificate, not Refresh CA Certificates

Quick workflow

ESXi Host Certificate Status alarm
        |
        v
Check Host -> Configure -> System -> Certificate
        |
        v
Is certificate close to expiry?
        |
       Yes
        |
        v
Check VMCA Root validity
        |
        +-- Root expiring -> Renew/replace VMCA Root first
        |
        +-- Root healthy
                |
                v
              Renew
                |
                v
       Validate new expiration date
                |
                v
         Clear/reset alarm

Related articles

• vCenter virtual disks show 0 GB or blank properties due to SSL trust mismatch
• vCenter certificate and Lookup Service health checks — planned

Sources

See the Broadcom references in the article metadata.