Knowledge Base

Troubleshooting: VMware Center Not Accepting SHA‑1 Root Certificate Overview: This guide explains how to diagnose and resolve the issue where VMware Center rejects a SHA‑1 root certificate, preventing proper certificate validation during secure commun

Updated on March 10, 2026

Troubleshooting: VMware Center Not Accepting SHA‑1 Root Certificate

Overview:

This guide explains how to diagnose and resolve the issue where VMware Center rejects a SHA‑1 root certificate, preventing proper certificate validation during secure communication.

Symptoms

You may be experiencing this issue if you notice:

VMware Center fails to validate a certificate signed with a SHA‑1 root certificate

Certificate-related warnings or trust errors appear during service initialization

Connectivity to VMware Center components fails due to certificate trust issues

Cause

This error typically occurs because VMware Center no longer supports SHA‑1 root certificates, which are considered insecure. VMware requires the use of SHA‑2 (SHA‑384) root certificates for trusted communication.

Solution

Follow these steps to resolve the issue by installing the supported UserTrust RSA Certification Authority Root Certificate (SHA‑384).

Step 1: Replace the SHA‑1 Root Certificate

Use the following UserTrust RSA Certification Authority (SHA‑384) root certificate supported by VMware:

Step 2: Save the Certificate

Copy the entire certificate block into a text editor (e.g., Notepad).

Save the file with the extension:
.crt

Step 3: Alternatively Download the Certificate

You may download the supported certificate from the official link:
Download Certificate
(Insert your actual URL here)

Step 4: Verify the Trust Chain

Ensure the trust chain includes only the following certificates:

Trust Chain Path

End Entity Certificate

Sectigo LimitedSectigo Public Code Signing Root E468F6371D8CC5AA7CA149667A98B5496398951E4319F7AFBCC6A660D673E438D0BCertificate | crt.sh

WebTrustSectigo Limited Sectigo Public Code Signing CA E36C2CFED7CEBBE2E733E21CAE659A734C83581FB72D321AB565B042EAA84C90CC3Certificate | crt.shWebTrustSectigo Limited Sectigo Public Code Signing CA EV E36

Important Note

Do not install the UserTrust RSA Cross‑signed intermediate issued by AAA Certificate Services.
VMware does not trust that cross‑signed certificate for validation.