"Signed certificate could not be retrieved due to a start time error" when adding ESXi host to vCenter Server 6.0
search cancel

"Signed certificate could not be retrieved due to a start time error" when adding ESXi host to vCenter Server 6.0

book

Article ID: 322260

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

When you replace the VMware Certificate Authority root certificate with an enterprise subordinate certificate, you experience these symptoms:

  • The certificate has been valid for less than 24 hours
  • You are unable to join a VMware vSphere ESXi host to VMware vCenter Server
  • You see the error:

    A general system error occurred: Unable to get signed certificate for host: esxi_hostname. Error: Start Time Error (70034)


Environment

VMware vCenter Server Appliance 6.0.x
VMware vSphere ESXi 6.0
VMware vSphere ESXi 5.0
VMware vSphere ESXi 5.5
VMware vCenter Server 6.0.x
VMware vSphere ESXi 5.1

Resolution

When adding a host to VMware vCenter Server, the VMware Certificate Authority pre-dates VMware vSphere ESXi certificates by 24 hours to avoid time synchronization issues.

For example :
  • Current time on vCenter is 10-Jan-2020 10:00
  • VMCA Root Cert is Valid from 10-Jan-2020 07:00
  • While trying to add the ESXi host to the vCenter Server, CSR will be generated with Start Date as "Current Date - 1 day" which means 09-Jan-2020 10:00:00
  • Here, VMCA is valid from 10-Jan-2020 07:00 and it got a request to Sign Certificate for a previous date 09-Jan-2020 10:00 which is not valid and operation fails
  • In this situation, advanced setting "vpxd.certmgmt.certs.minutesBefore" helps to customize the start date of ESXi certificate instead of default 24 hours

This behavior is changed in VMware vCenter 6.0 Update 2 and later with the advanced setting vpxd.certmgmt.certs.minutesBefore, available at VMware Downloads. For more information, see the VMware vCenter Server 6.0 Update 2 release notes.
 
To change the vpxd.certmgmt.certs.minutesBefore to 10:
  1. Connect to the vCenter Server using the vSphere Client and administrator credentials.
  2. Select Administration > vCenter Server Settings to display the vCenter Server Settings dialog box.
  3. In the settings list, select Advanced Settings.
  4. In the Key field, type a key.
  5. In the Key field, enter this key:

    vpxd.certmgmt.certs.minutesBefore
     
  6. In the Value field, enter:

    10
     
  7. Click Add.
  8. Click OK.
To work around this issue if you do not want to upgrade, use one of these options:
  • Wait 24 hours after replacing the VMware Certificate Authority certificate with an enterprise subordinate certificate before attempting to add additional hosts to vCenter Server.
  • Join hosts to VMware vCenter Server prior to replacing the VMware Certificate Authority certificate with an enterprise subordinate certificate.

    Note: VMware vSphere ESXi hosts added to VMware vCenter Server prior to replacing the VMware Certificate Authority certificate are not affected.

Additional Information

For translated versions of this article, see:
Powered by Wolken Software