SundayHK
打开vCenter网页显示no healthy upstream报错
解决办法：
1、使用SSH访问VSCA主机。
2、输入如下命令，检查证书有效期，发现__MACHINE_CERT证书到期。
for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; sudo /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; doneSTORE MACHINE_SSL_CERT
Alias : __MACHINE_CERT
Not After : Sep 22 15:23:23 2025 GMT
STORE TRUSTED_ROOTS
Alias : 6deac889ee304d803a2203d3205cde458e42f8a2
Not After : Sep 17 03:23:22 2033 GMT
STORE TRUSTED_ROOT_CRLS
Alias : c67d0ce9da55f07ca364bc1e9b3846adf42f48ba
STORE machine
Alias : machine
Not After : Sep 17 03:23:22 2033 GMT
STORE vsphere-webclient
Alias : vsphere-webclient
Not After : Sep 17 03:23:22 2033 GMT
STORE vpxd
Alias : vpxd
Not After : Sep 17 03:23:22 2033 GMT
STORE vpxd-extension
Alias : vpxd-extension
Not After : Sep 17 03:23:22 2033 GMT
STORE hvc
Alias : hvc
Not After : Sep 17 03:23:22 2033 GMT
STORE data-encipherment
Alias : data-encipherment
Not After : Sep 17 03:23:22 2033 GMT
STORE APPLMGMT_PASSWORD
STORE SMS
Alias : sms_self_signed
Not After : Sep 23 03:33:28 2033 GMT
Alias : https://192.168.1.15:9080/version.xml
Not After : Jan 17 00:19:30 2030 GMT
Alias : https://192.168.1.14:9080/version.xml
Not After : Nov 29 23:09:54 2035 GMT
Alias : https://192.168.1.16:9080/version.xml
Not After : Jul 21 00:50:35 2036 GMT
Alias : https://192.168.1.17:9080/version.xml
Not After : Jul 17 08:16:13 2036 GMT
STORE wcp
Alias : wcp
Not After : Sep 17 03:23:22 2033 GMT可以看到上面__MACHINE_CERT证书过期了
3、执行如下命令重新生成证书。
$ hostname -f
vcenter.sundayhk.com
$ ifconfig
192.168.1.9下面IP和Hostname要输入正确，不然会重启服务失败
/usr/lib/vmware-vmca/bin/certificate-manager _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 7.0 Certificate Manager *** |
| |
| -- Select Operation -- |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| NOTE: Solution user certs will be deprecated in a future |
| release of vCenter. Refer to release notes for more details.|
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : y
Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:administrator@xwx.local
Enter password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ? : Y
Press Enter key to skip optional parameters or use Previous value.
Enter proper value for 'Country' [Previous value : US] :
Enter proper value for 'Name' [Previous value : CA] :
Enter proper value for 'Organization' [Previous value : VMware] :
Enter proper value for 'OrgUnit' [Previous value : VMware Engineering] :
Enter proper value for 'State' [Previous value : California] :
Enter proper value for 'Locality' [Previous value : Palo Alto] :
Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : 192.168.1.9 # vcenter IP
Enter proper value for 'Email' [Previous value : email@acme.com] :
Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter.sundayhk.com # vcenter Hostname
Enter proper value for VMCA 'Name' : vcenter # vcenter Hostname
Continue operation : Option[Y/N] ? : y
You are going to reset by regenerating Root Certificate and replace all certificates using VMCA
Continue operation : Option[Y/N] ? : y
Status : 60% Completed [Reset vpxd-extension Cert...]
2025-09-26T05:42:20.975Z Updating certificate for "com.vmware.vim.eam" extension
2025-09-26T05:42:21.509Z Updating certificate for "com.vmware.rbd" extension
2025-09-26T05:42:22.041Z Updating certificate for "com.vmware.imagebuilder" extension
Reset status : 85% Completed [starting services...]
Reset status : 100% Completed [Reset completed successfully]https://knowledge.broadcom.com/external/article?legacyId=2147144
https://knowledge.broadcom.com/external/article?legacyId=2097936
https://www.youtube.com/watch?v=dCFoNfRFOrQ
