Symptoms

Open vCenter web page, go to VxRail Cluster > Configure > VxRail > Certificate > All Trust Store Certificates. The page shows that some non-vCenter CA certificates are expired or expire in less than 60 days.

Cause

Some non-vCenter CA certificates in the VxRail Manager Trust Store have expired or expire soon.

Resolution

Delete the expired or expiring certificates. Goto VxRail Cluster > Configure > VxRail > Certificate > All Trust Store Certificates, copy the File path and Fingerprint value of the expired or expiring certificates. SSH to VxRail Manager, switch to root user, run command openssl x509 -in <Certificate file path> -noout -issuer to check the certificate issuer, it helps to determine who issued this certificate and where you can renew it.From your web browser, open VxRail embedded API tool https://<VxRail_Manager_IP_address>/rest/vxm/api-doc.html Go to Certificates section > Delete the certificate fileEnter vSphere Username > vSphere Password, and enter the fingerprint of the certificate that you want to delete, then click Send Request. For example: Log in to the VxRail plug-in Certificate page again to confirm the expired or expiring certificates are deleted. Note: If the VxRail plug-in Certificate page gives an error stating "The provided vCenter credentials are not valid" or "The VxRail Manager failed to connect to the vCenter over HTTPS. See article 000214474 for troubleshooting details", it should be due to the browser cookie for the vCenter session has expired or the cookie is cleared since you deleted the certificate. This is an expected behavior, there is no requirement to troubleshoot this error. Move to the next step for importing certificates into the VxRail Manager trust store. Import the renewed certificate into the VxRail manager trust store. According to the certificate issuer, renew the certificate from a certain CA and copy the updated certificate to a Linux machine.Run the below command to get the certificate text format content, it should start with "-----BEGIN CERTIFICATE-----" and end with "-----END CERTIFICATE-----." sed -z -e 's/\n/\\n/g' <certificate_file> From your web browser, open VxRail embedded API tool https://<VxRail_Manager_IP_address>/rest/vxm/api-doc.html Go to Certificates section > Import certificates into the VxRail Manager trust storeEnter vSphere Username > vSphere Password, and the certificate contents in the request body and click Send Request. You can input multiple certificate contents in the request body with the below format: { "certs" :[ "<certificate content #1>", "<certificate content #2>", "<certificate content #n>" ] } For example: Log in to the VxRail plug-in Certificate page again to confirm the certificates are updated.

Support Cases