STS certificate expiration

[flipflip]

Hello,

I currently have an old version of vSphere 5.5 (yes, it's old ;) ) that is in the process of being migrated to the latest version.

The problem is that since this morning, I haven't been able to connect with the vSphere client or the web client. It seems to be an issue with the STS certificate, which has expired. After a lot of research and a few attempts, I haven't been able to get the vSphere server working again, and all the documentation I found is for version 6.x :( Do you have any suggestions to at least get it working until the end of the year?

The error is the same as on this page : https://knowledge.broadcom.com/external/article?legacyId=76719

ERROR com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl$RequestResponseProcessor opId=] Server rejected the provided time range. Cause:ns0:InvalidTimeRange: The token authority rejected an issue request for TimePeriod [startTime=Date MM DD:TT:SS EST YYYY, endTime=Date MM DD:TT:SS EST YYYY] :: Signing certificate is not valid at Date MM DD:TT:SS EST YYYY, cert validity: TimePeriod [startTime=Date MM DD:TT:SS EST YYYY, endTime=Date MM DD:TT:SS EST YYYY]

Thank you in advance.

[Navin A]

Hello Flip,

Not sure if its a windows vCenter or Appliance

Windows:
Stop the STS Service by running the command:

net stop VMwareSTS
 
Navigate to default vmware-sso directory

cd c:\ProgramData\VMware\CIS\cfg\vmware-sso
 
Run this command to re-install the STS with the default STS certificate:

"c:\Program Files\Common Files\VMware\VMware vCenter Server - Java Components\bin\java.exe" -cp "c:\Program Files\VMware\Infrastructure\VMware\CIS\vmware-sso\*;c:\Program Files\VMware\Infrastructure\VMware\CIS\vmware-sso\lib\*;.;*" com.vmware.identity.installer.STSInstaller --install --root-cert-path ssoserverRoot.crt --cert-path ssoserverSign.crt --private-key-path ssoserverSign.key --retry-count 2 --retry-interval 30
 
Start the STS Service by running this command:

net start VMwareSTS

Appliance: 

export JAVA_BIN=/usr/java/jre-vmware/bin/java
export CLASSPATH=/opt/vmware/lib64/*:/usr/lib/vmware-sso/commonlib/*
export _SSO_ROOT_CERT_X509=/etc/vmware-sso/keys/ssoserverRoot.crt
export _SSO_SIGNING_LEAF_CERT_X509=/etc/vmware-sso/keys/ssoserverSign.crt
export _SSO_SIGNING_LEAF_CERT_KEY=/etc/vmware-sso/keys/ssoserverSign.key
$JAVA_BIN -cp $CLASSPATH com.vmware.identity.installer.STSInstaller --install --root-cert-path "$_SSO_ROOT_CERT_X509" --cert-path "$_SSO_SIGNING_LEAF_CERT_X509" --private-key-path "$_SSO_SIGNING_LEAF_CERT_KEY"

[flipflip]

Thank you for your response.

 

It is an appliance on Linux Suse.

I just tested the appliance part :

And even after a reboot, I get the same error.

Now, when I try to connect to https://<IP>:5480, I get the following error (my password is correct):

[flipflip]

Hello everyone,

I managed to generate valid certificates thanks to this documentation : Regenerating Self-Signed SSL Certificates in VMware vCenter Server appliance 5.1 or 5.5 . Unfortunately, after rebooting the vSphere server, I still get the error message:

Cannot authentificat user

Return code is: InvalidCredentials

And the vSphere server part still does not start.

[Shen88]

The "Invalid Credentials" error combined with "STS Certificate" concerns in vCenter Server Appliance (VCSA) 5.1 or 5.5 typically points to an expired or invalid Security Token Service (STS) signing certificate or a mismatch in LDAP bind credentials.

Likely expired STS Certificate: The STS certificate is crucial for token-based authentication. If it expires, the VMware Directory Service (vmdird) and STS services often fail to authenticate users, leading to "Invalid Credentials" (frequently reported as LDAP error 49).

• LDAP Bind Failure: VCSA stores machine account passwords. If the password in the registry does not match the password in the vmdird database (often caused by snapshot reverts or backups), the vmware-sts service will fail to start.
  
  

Troubleshooting Recommendation:

Given that VCSA 5.1 and 5.5 are end-of-life versions, the specific modern troubleshooting tools (such as vCert or dir-cli) referenced in current documentation may not be available or applicable.

1. Check Service Logs: Inspect the following logs for specific error codes or "Invalid Credentials" messages:
   • /var/log/vmware/vmdird/vmdird-syslog.log
   • /var/log/vmware/sso/vmware-identity-sts.log
   • Look for SASL errors or LDAP error 49.
2. Verify Service Status: Confirm if the vmware-sts and vmdird services are running. If they fail to start, authentication will be impossible.
3. Restore or Revert: If this issue started after reverting to a snapshot or restoring from a backup, the machine account password in the registry and vmdird database are likely out of sync.

------------------------------
If you find this answer right, please 'Recommend' this post.

Thank you!

Regards,
Shen
------------------------------

[paolo musazzi]

Hi, I have this problem. After 10 years, the vCenter certificates have expired. The vCenter is on the Windows platform and all the VMware guides are no longer available. The certificates are self-generated ones. Do you have any guides for regenerating the self-signed ones?

[ggathagan]

I have no fix for your specific problem, but does your migration involve running newer versions of vSphere on different host hardware?
If so, is there any way to attach your new hosts to the datastores of the old hosts?
That would allow you to add the VM's to the inventory of the new host inventory and migrate the VMs to new datastores.

[paolo musazzi]

Hello navin and for all certificate expired? 5.5 applicance windows 

if pospone the date after anda valdifate the vmare 5.5 work 

you have a procedure please 

many tnx