VxRail: Health Check Fails for Test 'sig_hash'

The sig_hash test detects weak signature used on vCenter, vCenter root store, and ESXi certificates.
All signatures using SHA1 are identified.

An attempt to upgrade vCenter or ESXi to 8.0 fails during precheck due to a weak certificate signature algorithm. Upgrading vCenter Server or ESXi 8.0 fails during precheck due to a weak certificate signature algorithm
 

#========================#======#=========#====================================================================#==============# 
|  Hostname / Category   |Status  Dell_KB |  Warnings or Failures, unless tests Passed                         ; Product S.N. | 
#========================#======#=========#====================================================================#==============# 
| VxRM                   | Failure 213273 | sig_hash: Signature algorithm check FAILED. See vxv.log for details.        No_SRS|
or
| VxRM                   | Warning 213273 | sig_hash: Signature algorithm check FAILED. See vxv.log for details.        No_SRS|

Support for SHA1 certificates was removed in vSphere 8, so the sig_hash test fails when SHA1 is found in vCenter/ESXi SSL or CA certificate signatures. 

The sig_hash tests the existence of SHA1 in the signature algorithm used on:

• The vCenter SSL connection
• The ESXi SSL connection
• The vCenter CA certificates found:
  • Below 7.0.240: /var/lib.vmware-marvin/trust
  • 7.0.240+: /var/lib.vmware-marvin/trust
  • Note: This should match the download.zip file from the vCenter UI start page, which should contain all CA certificates from vCenter's root store.
    • The test does NOT connect to vCenter like above mentioned KB describes. As the files exist locally, those are being checked.
    • It does NOT detect if new certificates were added to the vCenter's root store

All tested certificates are listed in the vxv.log.
To find the offending ones, use this command:

grep "sig_hash" vxv.log | sed 's/, /\r\n/g' | grep sha1

VxVerify saves logs in: /tmp/vxv/ or /var/log/mystic/vxv/
Example from Lab:

vcluster101-vxrm:/home/mystic # grep "sig_hash" vxv.log | sed 's/, /\r\n/g' | grep sha1
list result: [{'bbddxxxx.0': 'sha1WithRSAEncryption'
'3257xxxx.0': 'sha1WithRSAEncryption'
'xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx': 'sha1WithRSAEncryption'
'vcluster101-esx01.vv001.local': 'sha1WithRSAEncryption'
vcluster101-vxrm:/home/mystic #

Entries with fully qualified domain name are the vCenter or ESXi certificates.
Entries with ".0" or thumbprint hash are either in '/var/lib.vmware-marvin/trust' or '/var/lib.vmware-marvin/trust/lin' depending on version.

Check the found offending certificates and replace them with new certificates with a stronger signature algorithm (for example, SHA256). For more information see: Upgrading vCenter Server or ESXi 8.0 fails during precheck due to a weak certificate signature algorithm 
<