How to change Certificate on VMware vCenter Server

Learn how to manually replace the Machine SSL certificate on VMware vCenter Server 7 or 8, prepare the chain, restart services, and verify VECS.

vCenter's Machine SSL certificate is the certificate clients see on the vSphere Client and API endpoint. It is separate from ESXi host certificates, solution-user certificates, and the VMCA root.

Before you begin

Take a supported file-based backup and a powered-off snapshot of the vCenter Server Appliance. In Enhanced Linked Mode, follow Broadcom's coordinated offline-snapshot guidance for every node in the SSO domain.
Use the appliance root account for CLI certificate tools and retain console access.
Obtain a certificate whose SAN matches the vCenter PNID/FQDN. Broadcom does not support wildcard certificates for vCenter Machine SSL.
Prepare three files in the format required by the selected workflow: leaf Machine SSL certificate, matching private key, and trusted chain with intermediates followed by root.

Understand vCenter certificate workflows

For vCenter 7.x/8.x, Broadcom supports the vSphere Client certificate-management UI, /usr/lib/vmware-vmca/bin/certificate-manager, and its newer vCert utility. Use one workflow end-to-end: a CSR generated in the vSphere Client must be completed there, and a Certificate Manager CSR/key must be imported through Certificate Manager.

Step-by-step certificate replacement

Confirm the PNID and current certificate:

/usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost
/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT --text

Start Certificate Manager and select Option 1: Replace Machine SSL certificate with Custom Certificate:
```
/usr/lib/vmware-vmca/bin/certificate-manager
```
Generate the CSR/key through its suboption if not already done. Have the CA sign that CSR without changing the key. Re-enter Option 1 and choose the import suboption; provide the signed leaf, the generated private key, and the complete CA chain.
Confirm the replacement. Certificate Manager updates VECS and restarts the relevant vCenter services. Wait for completion; do not interrupt it because the UI briefly becomes unavailable.
If using the vSphere Client instead, use Administration > Certificate Management > Machine SSL Certificate > Actions > Import and Replace Certificate and upload material that matches the CSR workflow selected in that UI.

Product-specific considerations

External Platform Services Controllers in legacy deployments have their own Machine SSL certificate and must be handled according to that version's topology. A Machine SSL operation does not replace certificates on ESXi hosts. Starting with vCenter 8.0 Update 3h, Broadcom documents native auto-renewal only for eligible VMCA-mode Machine SSL certificates; it does not make arbitrary external-CA replacement steps disappear.

Verify the new certificate

service-control --status --all
/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT --text

Open the vSphere Client and API using the PNID/FQDN, inspect the certificate and chain, log in, open a VM console, and verify Enhanced Linked Mode peers and integrations.

Rollback

Prefer Certificate Manager/vCert's supported recovery path. If the appliance is unrecoverable, revert the coordinated powered-off snapshots according to the ELM runbook; reverting only one linked node can damage replication consistency.

Common problems

SAN does not contain the PNID or uses an unsupported wildcard.
Leaf, key, and CSR came from different workflows.
Chain file is incomplete or ordered incorrectly.
An SSO administrator is used where OS-level root is required.
Only vCenter is updated while an integration pins the old fingerprint.

Automating certificate replacement with aethercert

The aethercert vCenter target replaces the vCenter Machine SSL certificate and key through the vSphere Automation API. It does not replace ESXi, VMCA root, or solution-user certificates.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.