You can replace all VMCA-signed certificates with new VMCA-signed certificates. This process is called renewing certificates. You can renew selected certificates or all certificates in your environment from the vSphere Client.

For certificate management, you have to supply the password of the administrator of the local domain (administrator@vsphere.local by default). If you are renewing certificates for a vCenter Server system, you also have to supply the vCenter Single Sign-On credentials for a user with administrator privileges on the vCenter Server system.

1. Log in with the vSphere Client to the vCenter Server connected to the Platform Services Controller.
2. Specify the user name and password for administrator@vsphere.local or another member of the vCenter Single Sign-On Administrators group.
3. If you specified a different domain during installation, log in as administrator@ mydomain.
4. Navigate to the Certificate Management UI.
5. From the Home menu, select Administration.
6. 
7. Under Certificates, click Certificate Management.
8. 
9. Enter the credentials of your vCenter Server.
10. 
11. Renew the machine SSL certificate for the local system.
12. Select Machine SSL Certificate.
13. Click Actions > Renew.
14. Click Renew.
15. A message appears that the certificate is renewed.
16. (Optional) Renew the Solution User certificates for the local system.
17. Under Solution Certificates, select a certificate.
18. Click Actions > Renew to renew individual selected certificates, or click Renew All to renew all solution user certificates.
19. 
20. A message appears that the certificate is renewed.
21. If your environment includes an external Platform Services Controller, you can then renew the certificates for each vCenter Server system.
22. Click the Logout button in the Certificate Management panel.
23. When prompted, specify the IP address or FQDN of the vCenter Server system and user name and password of a vCenter Server administrator who can authenticate to vCenter Single Sign-On.
24. Renew the machine SSL certificate on the vCenter Server and, optionally, each solution user certificate.
25. If you have multiple vCenter Server systems in your environment, repeat the process for each system.

Restart services on the Platform Services Controller. You can either restart the Platform Services Controller, or run the following commands from the command line:

1. Log into vCenter Access Management Interface https:\\:5480
2. Use vCenter Root credentials
3. Navigate to Access > Click Edit > Enable SSH
4. Open Putty and SSH into
5. Run the commands below:

service-control —stop —all service-control —start —all

1. Verify certificate on vcenter webpage is now updated.
2. Log into vCenter Access Management Interface https:\\:5480
3. Navigate to Access > Click Edit > Disable SSH

Replace Certificates with New VMCA-Signed Certificates from the vSphere Client (vmware.com)