VxRail: ESXi Certificate is Expired, Cannot Validate Install

Validation failures due to an expired ESXi certificate

During VxRail validation, the following symptoms may be observed:

• Errors indicating that the system cannot connect to or communicate with a host.
• A particular host reports that its ESXi certificate has expired.
• The marvin.log file contains certificate‑related exceptions.

Typical log entries include:

java.security.cert.CertificateException: Certificate with thumbprint : 13:04:29:4B:23:94:3D:08:3F:57:7C:xx:xx:xx:xx:xx:xx:xx:xx:xx is expired
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificate with thumbprint : 13:04:29:4B:23:94:3D:08:3F:57:7C:xx:xx:xx:xx:xx:xx:xx:xx:xx is expired

Visual reference:

Regenerate Expired ESXi Host Certificates.

1. Log in to the ESXi Shell and obtain root privileges.

   # su -
   Password:

2. Navigate to the SSL directory where the host certificates are stored.

   # cd /etc/vmware/ssl

3. Back up the existing certificates by renaming them.

   # mv rui.cert orig.rui.crt
   # mv rui.key  orig.rui.key

4. Generate new self‑signed certificates.

   # /sbin/generate-certificates

   You may see the following warnings; they can be ignored:

   WARNING: can't open config file: /usr/ssl/openssl.cnf
   WARNING: can't open config file: /etc/pki/tls/openssl.cnf

5. Confirm that new certificates were created and that their timestamps are newer than the .orig files.

   # ls -la
   -rw-r--r-- 1 root root  1.2K 2024-11-01 12:34 rui.cert
   -rw-r--r-- 1 root root  1.2K 2024-11-01 12:34 rui.key
   -rw-r--r-- 1 root root  1.2K 2024-10-15 09:20 orig.rui.crt
   -rw-r--r-- 1 root root  1.2K 2024-10-15 09:20 orig.rui.key

6. Restart the ESXi host to apply the new certificates.

   # reboot

7. After the host comes back online, re‑run the VxRail validation to ensure that the issue is resolved.