How to Recover from Expired vCenter 7 (ESXI) Certificates: A Step-by-Step Guide 2025

"Recently I encountered a situation where vCenter 7's certificates had expired, causing authentication failures and preventing access to both the web UI and host connections. The expired certificates also impacted our High Availability (HA) system, leaving our infrastructure vulnerable. This was particularly concerning as our VMs were hosted on SAN storage and proper vCenter access was crucial for maintaining redundancy. Here's how I resolved it.

The Symptoms:

• Could not log into vCenter web UI (certificate errors after login attempt)
• Hosts showing "no healthy upstream"
• iSCSI connection failures
• Error message: "Exception in invoking authentication handler SSL certificate verify failed: certificate has expired"

Prerequisites:

• Physical or virtual console access to vCenter
• [e-mail] credentials
• Ability to take snapshots of vCenter (for safety)

Step 1: Safety First

Before attempting any fixes, create a snapshot of your vCenter appliance. This gives you a rollback point if needed.

Step 2: Reset Root Password (if you don't have it)

1. Reboot the vCenter appliance
2. When you see the GNU GRUB boot menu, press 'e' to edit
3. Find the line starting with "linux" (use arrow keys)
4. Move to the end of that line (Ctrl + e)
5. Add "rw init=/bin/bash" to the end
6. Press Ctrl + x to boot
7. Once in single user mode, set a new root password
8. Reboot the appliance

Step 3: Certificate Renewal

1. SSH into vCenter using root and your new password
2. Run the certificate manager tool: /usr/lib/vmware-vmca/bin/certificate-manager
3. Select option 8 (Reset all certificates)
4. When prompted:
5. Enter your vCenter's IP address
6. For hostname, use the output of the 'hostname' command
7. Follow the prompts to complete the certificate renewal

Step 4: Verification

After the certificate renewal completes:
Try logging into the vCenter web UI
Check host connections
Verify iSCSI connections are restored
Remove the snapshot if everything is working correctly

Troubleshooting Tips:

• If SSH access is refused, you may need to enable it through the DCUI (Direct Console UI)
• Make sure to use [e-mail] (not admin or administrator) for the SSO credentials
• Keep track of the new root password in a secure location
• Monitor /var/log/vmware/vmcad/certificate-manager.log for detailed certificate operation logs

This solution worked for vCenter 7, but always check VMware's documentation for your specific version and environment.

Hope this helps someone, if it does, like or comment. Thanks :)