![](http://vmattroman.com/wp-content/uploads/2023/02/tanzu-cert-1024x560.png)
The last time I tried to login to PoC vCenter, I ran into problems. After checking a few things, it turned out that the problem was an expired certificate. In this case, it is easy to regenerate it using the built-in Certificate Manager on the vCenter server. Then I saw that Workloadload Management infinitely reconfigures…
1. Sympomts:
Workload Management is in Configuring state.
![](https://vmattroman.com/wp-content/uploads/2023/02/screen3-1024x259.png)
Kubernetes Status has some Warnings.
![](http://vmattroman.com/wp-content/uploads/2023/02/screen2-e1676582914510-1024x705.png)
Let’s see at the logs from the vCenter Server:
tail -f /var/log/vmware/wcp/wcpsvc.log
![](http://vmattroman.com/wp-content/uploads/2023/02/tanzu-cert-1024x560.png)
There are many errors with EAM service.
When you update vCenter certificates, Certificate Manager is unable to automatically update the EAM certificate.
The workaround/soluition is to run the updateExtensionCertInVC.py to fix this problem.
2. Resolution
- Log in to the vCenter Server Appliance using SSH and access to the Bash shell:
![](https://vmattroman.com/wp-content/uploads/2023/02/screen3-1.png)
2. Create “/certificate” folder and than retrieve the vpxd-extension solution user certificate and key
mkdir /certificate
/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store vpxd-extension --alias vpxd-extension --output /certificate/vpxd-extension.crt
/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store vpxd-extension --alias vpxd-extension --output /certificate/vpxd-extension.key
![](https://vmattroman.com/wp-content/uploads/2023/02/screen4-1024x63.png)
3. Run this command to update configuration. Remember to chage vCenter name and Administrator domain to @vsphere.local
python /usr/lib/vmware-vpx/scripts/updateExtensionCertInVC.py -e com.vmware.vim.eam -c /certificate/vpxd-extension.crt -k /certificate/vpxd-extension.key -s vmware-vcs-01.infra.home -u Administrator@vsphere.local
![](https://vmattroman.com/wp-content/uploads/2023/02/screen5-1024x499.png)
Successfully updated certificate for “com.vmware.vim.eam” extension line is present. That means, the procedure goes well despite SSL errros at below: [SSL:CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for ‘sdkTunnel’. (_ssl.c:1076)
4. Restart EAM service and start all other services.
If you want, you can stop all services and than, start all. In that case, change first command to:
service-control –stop -all
service-control --stop vmware-eam
service-control --start --all
![](https://vmattroman.com/wp-content/uploads/2023/02/screen6.png)
5. Great, all services are up and Workload Management status is in Running state 🙂
![](https://vmattroman.com/wp-content/uploads/2023/02/screen7-1024x245.png)
Source:
KB from VMware: https://kb.vmware.com/s/article/80588