The vpxd-svcs service start failed after reset all certificates
VCSA 6.7
Symptoms
~]# service-control --start --all Operation not cancellable. Please waitfor it to finish... Performing start operation on service lwsmd... Successfully started service lwsmd Performing start operation on service vmafdd... Successfully started service vmafdd Performing start operation on service vmdird... Successfully started service vmdird Performing start operation on service vmcad... Successfully started service vmcad Performing start operation on profile: ALL... Successfully started service vmware-vmon Service-control failed. Error: Failed to start services in profile ALL. RC=1, stderr=Failed to start vmware-vapi-endpoint vmware-vpxd-svcs services. Error: Operation timed out
2026-07-02T16:52:10.369+08:00 [Thread-9 ERROR com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl$RequestResponseProcessor opId=] Server rejected the provided time range. Cause:ns0:InvalidTimeRange: The token authority rejected an issue request for TimePeriod [startTime=Thu Jul 02 16:52:10 CST 2026, endTime=Fri Jul 03 16:52:10 CST 2026] :: Signing certificate is not valid at Thu Jul 02 16:52:10 CST 2026, cert validity: TimePeriod [startTime=Thu Jun 27 14:33:10 CST 2024, endTime=Sat Jun 27 14:33:10 CST 2026] 2026-07-02T16:52:10.370+08:00 [Thread-9 WARN com.vmware.cis.server.util.impl.InitPoolTask opId=] Init pool encountered exception: com.vmware.cis.server.util.exception.VpxdClientException at attempt 7 2026-07-02T16:52:26.825+08:00 [refresh-lotus-locator-task INFO com.vmware.cis.lotus.LotusLocator opId=] vmAfClient.getDomainControllerEx("") : 192.168.161.173 2026-07-02T16:52:26.826+08:00 [refresh-lotus-locator-task INFO com.vmware.cis.lotus.LotusLocator opId=] Lotus hostname URL : 192.168.161.173 2026-07-02T16:52:26.828+08:00 [refresh-lotus-locator-task INFO com.vmware.cis.lotus.LotusLocator opId=] vmAfClient.getDomainName() in baseDn format : dc=vsphere,dc=local 2026-07-02T16:52:26.833+08:00 [refresh-lotus-locator-task INFO com.vmware.cis.lotus.LotusLocator opId=] Successfully refreshed machine account credentials 2026-07-02T16:52:30.392+08:00 [Thread-9 INFO com.vmware.vim.sso.client.impl.SiteAffinityServiceDiscovery opId=] Site affinity is disabled 2026-07-02T16:52:30.531+08:00 [Thread-9 ERROR com.vmware.vim.sso.client.impl.SoapBindingImpl opId=] SOAP fault com.sun.xml.internal.ws.fault.ServerSOAPFaultException: Client received SOAP Fault from server: The token authority rejected an issue request for TimePeriod [startTime=Thu Jul 02 16:52:30 CST 2026, endTime=Fri Jul 03 16:52:30 CST 2026] :: Signing certificate is not valid at Thu Jul 02 16:52:30 CST 2026, cert validity: TimePeriod [startTime=Thu Jun 27 14:33:10 CST 2024, endTime=Sat Jun 27 14:33:10 CST 2026] Please see the server log to find more detail regarding exact cause of the failure. at com.sun.xml.internal.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:178) at com.sun.xml.internal.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:116) at com.sun.xml.internal.ws.client.dispatch.DispatchImpl.doInvoke(DispatchImpl.java:259) at com.sun.xml.internal.ws.client.dispatch.DispatchImpl.invoke(DispatchImpl.java:289) at com.vmware.vim.sso.client.impl.SoapBindingImpl.sendMessage(SoapBindingImpl.java:161) at com.vmware.vim.sso.client.impl.SoapBindingImpl.sendMessage(SoapBindingImpl.java:114) at com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl$RequestResponseProcessor.sendRequest(SecurityTokenServiceImpl.java:927) at com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl$RequestResponseProcessor.executeRoundtrip(SecurityTokenServiceImpl.java:856) at com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl.acquireTokenByCertificate(SecurityTokenServiceImpl.java:477) at com.vmware.cis.server.ssoauthentication.impl.SolutionTokenProvider.acquireSamlToken(SolutionTokenProvider.java:27) at com.vmware.cis.server.ssoauthentication.impl.AbstractTokenProvider.getSamlToken(AbstractTokenProvider.java:42) at com.vmware.cis.server.util.VpxdClient.loginBySamlToken(VpxdClient.java:174) at com.vmware.cis.server.util.VpxdClient.login(VpxdClient.java:71) at com.vmware.cis.server.util.ConnectionManager$1.makeObject(ConnectionManager.java:153) at com.vmware.cis.server.util.ConnectionManager$1.makeObject(ConnectionManager.java:143) at org.apache.commons.pool.impl.GenericObjectPool.addObject(GenericObjectPool.java:1691) at com.vmware.cis.server.util.impl.InitPoolTask.run(InitPoolTask.java:44) at java.lang.Thread.run(Thread.java:750) 2026-07-02T16:52:30.533+08:00 [Thread-9 ERROR com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl$RequestResponseProcessor opId=] Server rejected the provided time range. Cause:ns0:InvalidTimeRange: The token authority rejected an issue request for TimePeriod [startTime=Thu Jul 02 16:52:30 CST 2026, endTime=Fri Jul 03 16:52:30 CST 2026] :: Signing certificate is not valid at Thu Jul 02 16:52:30 CST 2026, cert validity: TimePeriod [startTime=Thu Jun 27 14:33:10 CST 2024, endTime=Sat Jun 27 14:33:10 CST 2026]
Cause
The root STS was updated, but the leaf STS was not updated by /usr/lib/vmware-vmca/bin/certificate-manager.
