登录 vcenter的5480 开启shell访问
执行shell 进入shell命令
/usr/lib/vmware-vmca/bin/certificate-manager
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.7 Certificate Manager *** |
| |
| -- Select Operation -- |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : n
Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]: 输入VCSA用户名
Enter password: 输入VCSA用户密码
Please configure certool.cfg with proper values before proceeding to next step.
Press Enter key to skip optional parameters or use Default value.
Enter proper value for 'Country' [Default value : US] : 默认回车
Enter proper value for 'Name' [Default value : CA] : 默认回车
Enter proper value for 'Organization' [Default value : VMware] : 默认回车
Enter proper value for 'OrgUnit' [Default value : VMware Engineering] : 默认回车
Enter proper value for 'State' [Default value : California] : 默认回车
Enter proper value for 'Locality' [Default value : Palo Alto] : 默认回车
Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : VCSA的地址，我这里是通过IP访问VCSA的，所以我这里直接输入IP就行
Enter proper value for 'Email' [Default value : email@acme.com] : 默认回车
Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : 我这里是IP，所以输入IP即可
Enter proper value for VMCA 'Name' : CA
Continue operation : Option[Y/N] ? : y
You are going to reset by regenerating Root Certificate and replace all certificates using VMCA
Continue operation : Option[Y/N] ? : y
Get site nameCompleted [Reset Machine SSL Cert...]
default-site
Lookup all services
Get service default-site:1622c0a4-9f7f-4e46-a372-493358367ac0
Don't update service default-site:1622c0a4-9f7f-4e46-a372-493358367ac0
......
Update service 260d4db9-51ce-4a33-ac66-2f16a23e0312; spec: /tmp/svcspec_fuxb_l13
Updated 34 service(s)
Status : 60% Completed [Reset vpxd-extension Cert...]
2026-10-15T02:03:22.020Z Updating certificate for "com.vmware.vim.eam" extension
2026-10-15T02:03:22.843Z Updating certificate for "com.vmware.rbd" extension
2026-10-15T02:03:23.406Z Updating certificate for "com.vmware.imagebuilder" extension
Reset status : 100% Completed [Reset completed successfully]
最后显示100%证书更新完成，此时再登录VCSA即可正常
注：为了避免某些服务没有正常运行，可考虑重启一次VCSA系统，并清除浏览器缓存或开无痕模式更新后eng'xin'h
完成更新后：
登录vcenter 进入 菜单》系统管理》证书》证书管理》登录后查看有效期
参考文章：由于VCSA的https自签证书过期导致的登录异常解决 - 吴昊博客
vSphere 证书过期更新全教程：certificate-manager 交互式重置一步到位_vsphere证书过期-CSDN博客