Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Checking Expiration of STS Certificate on vCenter Servers (79248)

Last Updated: 2/22/2024Categories: TroubleshootingTotal Views: 364455Language:
Chinese (Simplified)KoreanJapaneseSpanishEnglish

245 like this article

Subscribe to get an email
newsletter with new updates

245 people found this helpful Please provide article feedback:

Learn how VMware Skyline Advisor and Skyline Health Diagnostics work together to provide proactive intelligence and self-service log analysis.

Use Skyline Advisor to avoid issues before they occur across VCF, vSphere, vSAN, NSX, vROps & Horizon. Skyline Findings are based on top KBs, VMSAs/CVEs and design best practices.

Use Skyline Health Diagnostics to root cause vSphere & vSAN logs when an issue occurs. Skyline Health Diagnostic Findings are based on top KBs and VMSA/CVEs. You can use the Skyline Health Diagnostics tool in online or offline mode.

If you require additional help from technical support, please use Skyline Advisor to initiate a Log Assist to reduce time to upload logs. TSEs can also initiate logs to reduce effort.

Symptoms

VMware Security Token Service (STS) certificate is about to expire.

VMware Secure Token Service (STS) certificate status check.

Purpose

This article provides steps to identify the expiry date of the VMware STS certificate.

Notes:

The certificate expiry alarm does not account for the STS certificate.

VMware recommends replacing the certificate if it is set to expire within 6 months. If the expiry date will occur in more than six months, schedule the certificate replacement at the appropriate time.

If the STS certificate is about to expire or if it is already expired, see:

"Signing certificate is not valid" error in VCSA 6.5.x/6.7.x and vCenter Server 7.0.x (76719)

"Signing certificate is not valid" error in vCenter Server 6.5.x and 6.7.x on Windows (79263)

Cause

Here are the scenarios where STS signing certificate is expected to have a lifetime of around 2 years.

Notes:

Not all 6.5 U2 or later but only 6.5 U2 or later on 6.5 release lines only.

Fresh installation of PSC/vCenter Server 6.5 starting with U2 or later (6.5 lines only).

Fresh installation of PSC/vCenter Server 6.5 U2 or any later 6.5 releases and upgraded to a later version including 6.7 and 7.0.

STS signing certificate has been replaced using certool post-installation of PSC or vCenter Server.

STS signing certificate has been replaced with custom certificate (Internal/External CA Signed).

Resolution

Important: In vCenter Server version 6.5U3k, 6.7 U3j, or 7.0 U1, you receive a weekly notification when the vCenter Single Sign-On Security Token Service (STS) signing certificate is close to expiration. Notifications start 90 days before the STS certificate expires and turn into daily over the last week before expiration.

To verify the expiry date of your VMware Security Token Service (STS):

HTML 5 client

Note: Available from vCenter Server 7.0 Update2 and later.

Connect to the vSphere HTML5 client through https://vcenter_server_ip_address_or_fqdn/ui.

From Home Menu, Select Administration.

Under Certificates, Click on Certificate Management.

View STS signing Certificate information.

Note: The card will have the following information:

"Valid until" date which indicates when the certificate will expire.

A green check for a valid certificate, and an orange check warning of a certificate expiration.

A View Details link to show additional details of the active certificate chain.

VCSA

Download the attached checksts.py script attached to this article.

Upload to attached script to the VCSA or external PSC.

For example, /tmp

Note: You may use WinSCP to upload the script to VCSA. For additional information, see Error when uploading files to vCenter Server Appliance using WinSCP (2107727).

If you get an error for connecting to the VCSA via WinSCP run the following command:

chsh -s /bin/bash root as per above the link.

Once the script has been successfully uploaded to VCSA, change the directory to /tmp.

For example:

cd /tmp

Run python checksts.py.

Windows

Download the attached checksts.py script attached to this article.

Upload to attached script to the Windows Server on which vCenter Server is installed:

For example %TEMP%

Once the script has been successfully uploaded to Windows, change the directory to %TEMP%.

Run "%VMWARE_PYTHON_BIN%" checksts.py.

Web Client Flash

Note: Adobe Flash Player is going End of Life (EOL) on Dec 31, 2020. The major web browser manufacturers have aligned their efforts to disable/stop running Flash applications around this date. For more information on a flash certificate, see VMware Flash End of Life and Supportability (78589).

Connect to the vSphere Web client through https://vcenter_server_ip_address_or_fqdn/vsphere-client.

Select Administration > Single Sign-On > Configuration > Certificates > STS Signing.

Note: You cannot view the STS certificate from the HTML5 client.

Related Information

Important: The certificate expiry alarm does not account for the STS certificate. The only method to determine the expiry date of the STS certificate is in the resolution of this article. VMware recommends occasionally check the STS certificate to ensure it does not expire. For additional information, see VMware's vSphere blog:
Signing Certificate is Not Valid – Security Token Service Certificate Issue in vSphere.

Download/replace or change/create STS certificate: For more information on Status Alarms for certificates other than STS certificates, see CertificateStatusAlarm - There are certificate that expired or about to expire / Certificate Status Change Alarm Triggered on VMware vCenter Server.

VMware Skyline Health Diagnostics for vSphere - FAQ
"503 Service Unavailable" error on the vSphere Web Client when logging in or accessing the vCenter Server

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)KoreanJapaneseSpanishEnglish

Attachments

checksts

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Server Appliance

VMware vCenter Server

Related Versions:

VMware vCenter Server Appliance 6.7.x

VMware vCenter Server Appliance 6.5.x

VMware vCenter Server 8.0.x

VMware vCenter Server 7.0.x

VMware vCenter Server 6.7.x

VMware vCenter Server 6.5.x

Take Our Survey

Support Assistant