The vCenter Server Security Token Service (STS) is a Web service that issues, validates, and renews security tokens.

As a token issuer, the Security Token Service (STS) uses a private key to sign the tokens and publishes the public certificates for services to verify the token signature. vCenter Server manages the STS signing certificates and stores them in the VMware Directory Service (vmdir). Tokens can have a significant lifetime, and historically might have been signed by any one of multiple keys.

STS Certificate Duration and Expiration

A fresh installation of vSphere 7.0 Update 1 and later creates an STS signing certificate with a duration of 10 years. When an STS signing certificate is close to expiring, an alarm warns you starting at 90 days once per week, and then daily when seven days away.

The alarm will be something like this:

Note that if STS certificate expire then access to vCenter will be unavailable!

STS Certificate Manual Renewal

You can refresh your vCenter Server STS signing certificates using the vSphere Client. The VMware Certificate Authority (VMCA) issues a new certificate and replaces the current certificate.

When you refresh STS signing certificates, the VMware Certificate Authority (VMCA) issues a new certificate and replaces the current certificate in the VMware Directory Service (vmdir). STS starts using the new certificate to issue new tokens. In an Enhanced Linked Mode configuration, vmdir uploads the new certificate from the issuing vCenter Server system to all linked vCenter Server systems. When you refresh STS signing certificates, you must restart the vCenter Server system, and any other vCenter Server system that is part of an Enhanced Linked Mode configuration.

1. Log in with the vSphere Client to the vCenter Server.
2. Specify the user name and password for [email protected] or another member of the vCenter Single Sign-On Administrators group.If you specified a different domain during installation, log in as administrator@ mydomain.
3. Navigate to the Certificate Management UI.
   1. From the Home menu, select Administration.
   2. Under Certificates, click Certificate Management.
4. If the system prompts you, enter the credentials of your vCenter Server.
5. Under STS Signing Certificate, click Actions > Refresh with vCenter certificate.

STS Certificate Auto-Renewal

In vSphere 8.0 and later, vCenter Single Sign-On automatically renews a VMCA-generated STS signing certificate. The auto-renewal occurs before the STS signing certificate expires and before triggering the 90-day expiration alarm. If the auto-renewal fails, vCenter Single Sign-On creates an error message in the log file. If necessary, you can refresh the STS signing certificate manually.