Regenerate Standalone ESXi Host Certificate | virten.net

On a freshly installed ESXi host, the following error is displayed:

The certificate assigned to tát this host is not valid yet. You should install a valid certificate.

The issue is caused by a system time that is mix to tát the future during ESXi installation. Having not configured the correct time can also cause issues when trying to tát add the ESXi host to tát vCenter Server. To solve the issue, mix the correct time (Best practice is to tát use an NTP server) and regenerate the certificate.

Fix timing issue:

1. Open ESXi Host Client
2. Navigate to tát Host > Manage > System > Time và date
3. Press Edit NTP Settings
4. Set the NTP startup policy to Start and stop with host
5. and add an NTP Server (eg. pool.ntp.org)
6. Press SAVE
7. Navigate to tát Host > Manage > System > Services
8. Highlight the NTP Daemon (ntpd) and press Start

Regenerate the certificate:

1. Navigate to tát Host > Manage > System > Services
2. Start the SSH Service
3. Connect to tát the ESXi host using SSH and login as root
4. Verify the current date and certificate start date.

   # date
   Mon Jul  2 19:19:58 UTC 2023
   
   # openssl s_client  -connect localhost:443 |grep notBefore
   verify error:num=9:certificate is not yet valid
   notBefore=Jul  3 23:03:15 2023 GMT

5. Regenerate the Certificate

   # /sbin/generate-certificates

6. Restart hostd

   # /etc/init.d/hostd restart

Note: This method should not be used when the ESXi host is already added to tát a vCenter Server. In that case, the certificate should be renewed using Right-Click ESXi Host in Inventory > Certificates > Renew Certificate