vCenter Server certificate stores and common certificate alarms

Purpose

vCenter Server uses several certificates for different internal and external functions.

A generic Certificate Status alarm does not always mean the public-facing Machine SSL certificate is expiring. The correct troubleshooting path starts by identifying which certificate store contains the expired or expiring certificate.

This reference provides a practical map of the main vCenter certificate stores and the first checks to perform.

List certificate stores

SSH to the VCSA and run:

/usr/lib/vmware-vmafd/bin/vecs-cli store list

Common stores include:

MACHINE_SSL_CERT
TRUSTED_ROOTS
TRUSTED_ROOT_CRLS
machine
vsphere-webclient
vpxd
vpxd-extension
hvc
data-encipherment
APPLMGMT_PASSWORD
SMS
wcp
BACKUP_STORE

Not every environment has every non-default store.

Check expiration dates across VECS

Use:

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do
  echo "===== STORE: $store ====="
  /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store "$store" --text |
  grep -ie "Alias" -ie "Not After"
done

This is a read-only inventory command and is a good first step for most vCenter certificate alarms.

Main certificate stores

MACHINE_SSL_CERT

Used by the vCenter reverse proxy and exposed to clients connecting to the vCenter HTTPS service.

Typical symptoms when unhealthy:

• Browser or API trust errors
• External backup/monitoring tools reject the certificate
• Machine SSL expiration alarms
• SSL handshake failures

Preferred management path:

• vCert
• Supported vSphere Client certificate replacement workflow where available

Do not replace it until the expiry date and chain have been verified.

TRUSTED_ROOTS

Contains trusted CA certificates used by vCenter.

Typical issues:

• Expired or stale root/issuer certificates
• Certificate Status alarms
• Storage profile or service health alarms in some cases
• Upgrade or health-check warnings

Expired roots must be reviewed carefully before removal. A stale root may no longer be used, but deleting an active trust anchor can break integrations.

Solution User stores

Typical Solution User stores include:

machine
vsphere-webclient
vpxd
vpxd-extension
hvc
wcp

These certificates authenticate internal vCenter services.

Typical symptoms when they expire:

• Solution User certificate alarms
• Internal service authentication failures
• vCenter functionality becoming partially unavailable

Use vCert or the vendor-supported certificate replacement procedure rather than manually generating replacement certificates.

SMS

The SMS certificate is used by the Storage Management Service.

SMS supports storage integrations such as VASA providers, and SPBM relies on SMS for parts of storage policy management.

An SMS certificate problem can therefore surface as a storage-management or profile-driven-storage issue rather than an obvious HTTPS problem.

data-encipherment

Used for encryption-related vCenter data such as guest customization specification secrets.

This is not the certificate presented to browsers.

Manage it with the supported certificate tooling documented by Broadcom.

APPLMGMT_PASSWORD

Contains a secret key used by appliance management for encrypted backup-related data.

It is not a normal TLS certificate store and does not follow the same renewal workflow as Machine SSL or Solution User certificates.

BACKUP_STORE

Created when certificate replacement workflows retain the previous Machine SSL and Solution User certificates for rollback.

Important characteristics:

• Contains historical backup copies
• Backup certificates are not active
• Expired backup certificates do not need to be renewed
• On affected versions, expired entries can still trigger Certificate Status

Preferred cleanup path:

vCert
  -> Manage Certificates
  -> Clear expired certificates in BACKUP_STORE in VECS

Certificates not necessarily stored in VECS

Not every important vCenter-related certificate is represented as a normal VECS store.

STS signing certificate

The Security Token Service signing certificate is handled separately from the standard VECS inventory.

Use vCert to check and manage STS certificate health.

STS expiration can cause severe authentication problems, including failed vSphere Client logins.

ESXi host certificates

VMCA-signed ESXi host certificates are stored locally on each ESXi host, not in vCenter VECS.

A host certificate alarm such as:

ESXi Host Certificate Status
Expiration imminent

should be handled from the ESXi host certificate workflow in vCenter.

Common alarm-to-store mapping

Certificate Status

Start with a full VECS inventory.

Possible causes include:

• Expiring Machine SSL certificate
• Expiring Solution User certificate
• Expired Trusted Root
• Expired historical certificate in BACKUP_STORE
• Other stale certificate entries

Do not renew certificates blindly. Identify the exact store and alias first.

MACHINE_SSL_CERT certificate is about to expire

Inspect MACHINE_SSL_CERT.

If genuinely approaching expiry, replace it with vCert or the supported vSphere Client workflow.

After replacement, the alarm may need to be manually reset to green.

Solution User certificate is about to expire

Inspect:

machine
vsphere-webclient
vpxd
vpxd-extension
hvc
wcp

Replace the Solution User certificates with the supported procedure.

Root certificate about to expire

Inspect TRUSTED_ROOTS.

Confirm whether the root is still in active use before removing or replacing it.

STS Signing Certificates are about to expire

Use vCert to inspect the STS certificate.

Treat STS certificate expiry as high priority because authentication can fail after expiration.

ESXi Host Certificate Status

This is a host certificate issue, not a normal vCenter VECS issue.

Inspect:

Host
  -> Configure
  -> System
  -> Certificate

and verify the VMCA Root validity before renewing the host certificate.

vCert as the primary certificate utility

Broadcom recommends vCert for current vCenter certificate management and repair workflows.

Typical uses include:

• Certificate health checks
• Machine SSL replacement
• Solution User certificate replacement
• VMCA certificate work
• STS certificate checks
• LDAPS certificate management
• Clearing expired BACKUP_STORE entries

Before any repair or replacement operation, follow the backup/snapshot requirements for the complete SSO domain.

Practical troubleshooting order

When a vCenter certificate alarm appears:

1. Record the exact alarm name.
2. Check the vCenter version.
3. List all VECS stores and Not After dates.
4. Identify the exact store and alias that is expired or expiring.
5. Determine whether the certificate is active, trusted, or only a historical backup.
6. Select the vendor-supported repair workflow.
7. Validate services and certificate dates after the change.
8. Reset the alarm to green if the underlying condition is already corrected.

Useful commands

List stores:

/usr/lib/vmware-vmafd/bin/vecs-cli store list

List one store:

/usr/lib/vmware-vmafd/bin/vecs-cli entry list   --store MACHINE_SSL_CERT   --text

List aliases and expiry dates across stores:

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do
  echo "===== STORE: $store ====="
  /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store "$store" --text |
  grep -ie "Alias" -ie "Not After"
done

Safety notes

• Do not delete certificates based only on an expired date
• Confirm whether the certificate is active or historical
• Do not manually replace Solution User or Machine SSL certificates unless following a supported procedure
• Take the required backup/snapshot before modifying certificate stores
• In Enhanced Linked Mode, coordinate protection across all vCenter nodes in the SSO domain
• Treat STS and trusted-root changes as higher-risk operations

Related knowledge

• vCenter Certificate Status alarm caused by expired BACKUP_STORE certificates
• vCenter virtual disks show 0 GB or blank properties due to SSL trust mismatch
• ESXi Host Certificate Status shows Expiration imminent

Sources

See the authoritative Broadcom references in the article metadata.