VMware vSphere

 View Only

 vcenter machine SSL certificate expired and error message [500] An error occurred while fetching identity providers

Jump to  Best Answer
nblr06's profile image
nblr06 posted Apr 22, 2025 02:31 AM

I have a vcenter server, its version is 7.0.3.02200 and was deployed to manage a small datacenter(not VCF) using default configurations on certificates.

Now, the login webpage of vcenter showed error message "[500] An error occurred while fetching identity providers" and I do know this article: Unable to access vCenter UI - An error occurred while fetching identity providers.  provided instructions to use the vCert tool to solve the issue.

And, yes, after checking the vcenter system using vCert.py, I found two abnormalities from the result of "Check current certificate status" while other certificates/values/settings are all good  

Checking Machine SSL certificate                          EXPIRED
Checking Auto Deploy CA certificate                       NO SKID

So i believe the root cause is the expired machine ssl certificate of this vcenter. 

I don't want the datacenter environment be affected when renewing the certificate thus, for me, it seemed that to solve this issue is to regenerate a valid machine ssl certificate but I have no experience on using vCert.py tool to achieve this.

Does anyone know whether or not vCert.py is able to both generate new one and replace the expired machine ssl certificate? Or maybe additional method shall be applied before using the vCert.py?

Deepak Vadakkedath's profile image
Deepak Vadakkedath  Best Answer

Procedure to renew expired Machine Certificate:

·         SSH to the vCenter Server Appliance (VCSA).

·         Login with vCenter root credential

·         Type shell then enter

·         Run : /usr/lib/vmware-vmca/bin/certificate-manager

·         Select Option 3: Replace Machine SSL certificate with VMCA Certificate

Follow the Prompts:

·         vCenter SSO username (e.g., administrator@vsphere.local)

·         SSO password

After entering required certificate details and confirming, the script will:

  • Generate a new certificate
  • Replace the expired machine SSL certificate
  • Restart necessary services