vCenter Service Unreachable After Cert Expiry or DNS Change

When This Shows Up

You try to open the vSphere Web Client or connect via PowerShell and get a 503 error, or the vCenter Server Appliance (VCSA) management interface shows services like vpxd or vsphere-ui as stopped. This almost always happens after a certificate expiration (typically the machine SSL cert or STS cert) or a DNS change that breaks service-to-service communication. I've seen it on vCenter 6.7, 7.0, and 8.0 — the culprit here is almost always the service control agent losing its mind.

Root Cause

vCenter runs a ton of microservices under a wrapper called the Lightwave Service Control Manager (lwsmd). When a certificate expires, the services can't authenticate to each other. They fail to start, and lwsmd marks them as unreachable. A DNS change can do the same — services register with a hostname, then the hostname changes or the forward/reverse lookup breaks.

Don't bother reinstalling vCenter. It's almost never needed. The service control agent just needs a kick and the services need to be re-registered.

Fix: Step-by-Step

1. SSH into the VCSA — use root credentials. If you can't SSH, you're in deeper trouble. Check the console via vSphere Client.
2. Check service status — run service-control --status. Look for services showing as STOPPED or DOWN. Common offenders: vpxd, vsphere-ui, pschealth.
3. Restart the service control agent — this is the key step. Run:

   service lwsmd restart

   Wait 30 seconds. Then run service-control --status again. You'll probably see the same services still down. That's fine — we just cleared the agent's cache.
4. Re-register the broken services — for each service that's down, run:

   service-control --register --service <service_name>

   Replace <service_name> with the actual name (e.g., vpxd, vsphere-ui). Do this for all stopped services.
5. Start all services — run:

   service-control --start --all

   This takes a few minutes. Watch the output for errors.
6. Verify — open the vSphere Web Client URL again. If it loads, you're done.

If Services Still Won't Start

You might have a certificate that's so expired that the service control agent refuses to touch it. In that case:

• For vCenter 7.0 and 8.0, run certificate-manager from the VAMI (port 5480) — go to Certificate > Renew. If the VAMI is also down, SSH and run:

/usr/lib/vmware-vmca/bin/certificate-manager

Then follow the prompts to regenerate the machine SSL cert. This will sync the certificates across services.

What to Check If It Still Fails

• DNS resolution — from the VCSA, run nslookup <vCenter_FQDN> and nslookup <vCenter_IP>. Both must resolve correctly. If not, fix your DNS first.
• Time sync — run chronyc tracking (or ntpq -p on older versions). If the clock is off by more than 5 minutes, certificates will fail validation. Sync with NTP.
• Disk space — run df -h. If /storage/seat is over 90% full, services won't start. Clean up logs in /var/log/vmware.
• Try a forced restart — sometimes service-control hangs. Run systemctl restart vmcad then service-control --start --all again.

In five years of managing vCenter, I've only seen this fail completely twice — once from a corrupted database, once from a botched upgrade. If none of the above works, call VMware support. You probably need to restore from backup.