STS Signing Certificates are about to expire - vCenter 7

[Sungpill Han]

 

Environment:

ESXI 6.5, vCenter  7.0.1

 

Hello Experts, 

I need your help on two certificate issues. 

1.  I received alert on vCenter "STS Signing Certificates are about to expire"

So I tried to follow below, but there's no STS signing certificate, but only Machine and CA certificates. 

 I have no issue signing into vCenter. Any idea? 

"STS Signing Certificates are about to expire" alert received in vSphere UI (83558) https://kb.vmware.com/s/article/83558?lang=en_US

I ran checksts.py and shows it will expire in 78 days. I am not sure if I need to run fixsts.py because the cert doesn't show in GUI at all. ..

 

 

2. Machine cert is about to expire.

When machine cert expires, what's the impact? 

How do I renew before it expires? will the steps to renew need to be in maintenance window?

 

Thank you in advance

[Sungpill Han]

Hello, 

I was able to update STS and Machine certificates. 

Then, I listed all certificates in vCenter and see multiple certificates expiring on 2022. Are they not being used or need to renew as well? If yes, how do I update them?

 

[Vijay2027]

You will have to use option 6 to reset solution user certificates. 

Expiry on back-up store can be ignored or if you want to clean-up follow https://kb.vmware.com/s/article/82560

[NAIKAKASH]

Instead of option 6 , I believe fixsts script should be use to generate new STS certificate.

Ref : https://kb.vmware.com/s/article/79263

[virtual-power]

STS HTML UI administration started with 7.0 U3 only. 

 

This KB is for sts replacement https://kb.vmware.com/s/article/76719  . But it does have inputs for other certs.

 

[mannharry]

• For Solution User certificates, please follow the KB https://kb.vmware.com/s/article/2112283 Option 6 from the certificate Manager.
• Also if these certs have expired, your VC will not be functional, so you must do it at the earliest.
• Back up store can be cleanedthe  with below https://kb.vmware.com/s/article/82560