• Logging in to the vSphere Web Client using admin@system-domain fails with the error:
  
  associated users password is expired
  
  
• The C:\Program Files\VMware\Infrastructure\SSOServer\ssolscli\ssopass command fails.
• You see a certificate error similar to:
  
  sslhandshakefailed
  
  
• Installing the vSphere Web Client after the SSO user account for admin@system-domain has expired fails with the error:

The provided credentials are not valid. Please check VM_ssoreg.log in system temporary folder for details

1. Stop the vCenter Single Sign-on service (SSO).
2. Log in to SQL Management Studio.
3. Go to the RSA database.
4. Expand Tables and highlight the dbo.IMS_AUTHN_PASSWORD_POLICY table.
5. Right-click and select Edit Top 200 Rows.
6. Scroll over to the MAX_LIFE_SEC column. The default setting is 31536000 seconds (365 days).
   
   Note: Select the policy that contains Password Policy for SSO system users within the NOTES field.
   
   
7. Increase this value (for example: 47304000 seconds = 546.5 days, 63072000 seconds = 730 days, 90000000 seconds = 1041days).
8. Restart the vCenter Single Sign-on service.
9. Log in to the vSphere Web Client to vCenter Server with admin@system-domain:default URL:
   
   https://vCenter-server-fqdn:9443
   
   
10. Navigate to Administration > Configuration.
11. Click the Policies tab.
12. Click Edit.
13. Change maximum lifetime to 0 (never expire) or enter the approximate number of days corresponding to the value you set in the database, MAX_LIFE_SEC field above.
14. Save your changes and exit the edit.

Note: Instead of steps 6 and 7, you can scroll to the column named PERIODIC_EXPIRE, and set that value to 0. This prevents password expiration. You should only do this if your security policy allows non-expiring passwords.

Note: An alternative method can be found at Resetting an expired password in vCenter Single Sign-On (SSO) (2035864).

• Number of days since installation + number of days the login should remain good = Number of days to enter in Administration > Configuration > Policies tab > Edit > maximum lifetime (Step 13)
• Number of days to enter * 86400 = number of seconds to enter in the MAX_LIFE_SEC column (Step 7)

Note: For more information on resetting the SSO password, see Unlocking and resetting the vCenter Single Sign-On administrator password (2034608).