Ultimate vSphere Certificate Renewal Guide

We can view the machine SSL cert directly from VCF Operations, head to Fleet Management/Certificates, expand VCF Instances, expand the VCF instance and select the workload domain, in my case Borealis

Here we can see our certificates

This doesnt show all the internal ones or the STS signing certificate, which are always worth checking
Broadcom have a very nice script for everything you need certificate wise here

Download the vCert zip at the bottom

You then need to transfer this to the vCenter with a tool like WinSCP or FileZilla

You get the error Received too large (1433299822 B) SFTP packet if the default shell is the appliance shell rather than bash

For FileZilla you will see something like this

To fix this, SSH into the vCenter and run the following to change the default shell to bash by running

shell

Then run

chsh -s /bin/bash root

To go back to the appliance shell use

chsh -s /bin/appliancesh

When you have it on the vCenter, run

unzip <zip-folder-name>

I ran

unzip vCert-6.1.0-20250910.zip

Then run

cd <folder-name>

I ran

cd vCert-6.1.0-20250910.zip

To run the scrip run

python vCert.py

We will see the main menu like this

To view the certificates menu, press 1, then press Enter
You will need an administrator account, usually [email protected], mine was [email protected] as I changed the SSO domain name
This will check the status of all certs we need and mark if they are expired or not

We can then use option 2 for view certificate details and get the exact expiring details

We can then use option 1 for the machine SSL certificate, which is in VCF Operations

We can use other options to check other certificates

Broadcom have a very nice script for everything you need certificate wise here

Download the vCert zip at the bottom

You then need to transfer this to the vCenter with a tool like WinSCP or FileZilla

You get the error Received too large (1433299822 B) SFTP packet if the default shell is the appliance shell rather than bash

For FileZilla you will see something like this

To fix this, SSH into the vCenter and run the following to change the default shell to bash by running

shell

Then run

chsh -s /bin/bash root

To go back to the appliance shell use

chsh -s /bin/appliancesh

When you have it on the vCenter, run

unzip <zip-folder-name>

I ran

unzip vCert-6.1.0-20250910.zip

Then run

cd <folder-name>

I ran

cd vCert-6.1.0-20250910.zip

To run the scrip run

python vCert.py

We will see the main menu like this

To view the certificates menu, press 1, then press Enter
You will need an administrator account, usually [email protected], mine was [email protected] as I changed the SSO domain name
This will check the status of all certs we need and mark if they are expired or not

We can then use option 2 for view certificate details and get the exact expiring details

We can then use option 1 for the machine SSL certificate, which is in VCF Operations

We can use other options to check other certificates, you will want to use this section to check anything that is marked as expired from earlier in the vCert script

Before proceeding, ensure you have a powered off snapshot of the vCenter
In VCF 9 you should not have ELM, however on earlier versions you may, and in ELM all members need to be shutdown and snapshot at the same time, if you need to restore all ELM members must be restored

In vSphere search and select the vCenter VM, we can see the host the vCenter is running on from the Related Objects box, note that host, then press the red stop button to shit the machine down gracefully

Log into the ESX UI, click Virtual machines, search for and find the vCenter VM, right click it and click Snapshots/Take Snapshot

Give it a name and click Take Snapshot

Then click Power On

Log into VCF Operations and click Fleet Management/Certificates, expand your VCF instances and select the workload domain the vCenter belongs to, use the radio button to select the vCenter component and click Renew Certificate

Click Yes

This will generate a certificate renewal task, this will take a little while

Part way through you will see this in the vSphere UI

When its done VCF Ops should show this

When checking manually, I can see a bunch of underlying certs were changed, so this should fix everything in Operations

I dont think the STS signing certificate was changed with this, however mine is valid for over 5 years, so I expect this to outlive the vCenter appliance is its unlikely to be an issue

If your certificates have already expired and renewing within VCF Operations doesnt work, open a ticket with Broadcom support, the SDDC Manager uses a lot of bits in the backend, like certificates, and its very easy to break VCF when you do things outside of the expected workflows and I am not 100% on the impact if you do manually change them

ESX certificates should be auto renewed from the vCenter and shouldnt need manually updating

However if they do, in VCF Operations check the toggle on the right to show ESX hosts, select the host and click Renew Certificate

Again, like with the vCenter, if this does fail, do not try and manually update it, log a support ticket with Broadcom to verify the correct method as this is not something I am 100% sure on, and when the SDDC Manager breaks connection its usually very painful to fix

Once its all done you may see some alerts like this in vCenter

This is almost always caused by the vCenter services not being restarted, as VCF Ops doesnt do this automatically
To resolve this either reboot the vCenter from VAMI, or ssh as root and run

service-control --stop --all ; service-control --start --all

Before proceeding, ensure you have a powered off snapshot of the vCenter
If you have ELM, all members need to be shutdown and snapshot at the same time, if you need to restore all ELM members must be restored

In vSphere search and select the vCenter VM, we can see the host the vCenter is running on from the Related Objects box, note that host, then press the red stop button to shit the machine down gracefully

Log into the ESX UI, click Virtual machines, search for and find the vCenter VM, right click it and click Snapshots/Take Snapshot

Give it a name and click Take Snapshot

Then click Power On

The easiest way to refresh certificates is to regenerate them all, you can use option 3 at the main menu to do individual ones

Generally, you want to be using the self signed certificates, I find custom CA certs add a lot of extra complexity and dont offer anything, so since everything is self signed, there isnt really a reason not to regenerate them all
At the main menu select option 6

We then need to enter vSphere administrator credentials, this is usually the [email protected] account, in my case it was [email protected] since I changed the SSO domain when I setup the vCenter

We then need to fill out the info, generally, most of this information doesnt matter, but the bits that do are the the following

• IP Address
• Hostname

IP address does say optional, and hostnames are laballed as additional, so I am not sure if the script it adding the base values that you need on its own, however the IP address and hostname have always been very important so I highly recommend adding in the correct bits here
IP address should be the vCenter IP and the hostname the vCenter FQDN

You will then see this indicating everything has been changed, and at the bottom a prompt for the STS signing certificate, as there are no running tasks I dont need to worry, if there are you should let them finish and enter Y

The STS signing certificate will then be renewed, trust anchors will be updated, and then we need to enter Y to restart all the services for the new certificates to take effect

This will take a little while to restart them all, but when its done you will be back on the main menu

If you are having issues where certificates arent renewing with 2 years, your VMCA certificate is likely stuck on that date, in that case follow, from the top menu level of the script, 3 then 9 and option 2 for Replace VMCA certificate with a self-signed certificate and regenerate all certificates

ESX certificates should be auto renewed from the vCenter and shouldnt need manually updating

However if they do need refreshing you can select the host and click System/Certificate/Manage With VMCA/Renew and get a new one from the vCenter