VMware vSphere · Troubleshooting guide

VMware Troubleshooting: vCenter STS Certificate Expiry and VMs That Lose Network After vMotion

Two recurring vSphere incidents with step-by-step recovery: expired STS certificates locking you out of vCenter, and network loss after migration.

Published August 28, 2026 · RCW IT Training

vCenter authentication

Login fails with 503 or 'Failed to verify the SSL certificate'

Usually the expired STS (Security Token Service) signing certificate - common on vCenter 6.7/7.0 after about two years. Check expiry in the VCSA with the vendor check script or certificate-manager. Fix with certificate-manager option 2 (replace STS) or option 1 (replace all), then service-control --restart --all. Take a VCSA snapshot beforehand and, in linked setups, fix the management domain first.

ESXi host shows 'Not responding' but its VMs run fine

A management-plane issue, not VM impact. Check hostd and vpxa on the host, DNS and NTP skew between host and vCenter, and firewalls on ports 443/902. Restart the management agents with services.sh restart - this is safe for running VMs.

Network after vMotion

VM loses network only after vMotion

Almost always a port-group or VLAN mismatch between source and destination: same port-group name but a different VLAN ID or dvSwitch uplink teaming. Compare esxcli network vswitch standard portgroup list on both hosts, verify destination uplinks with esxcli network nic list, and confirm the ToR switch trunks the VLAN on both racks. Also review MAC security policies on dvPortGroups.

Ping works inside the VM but not from outside after migration

Stale ARP entries on the upstream router after the VM changed Layer-2 location. Restart the VM or send a gratuitous ARP, and enable 'Notify Switches' on the dvSwitch port group so the fabric updates MAC tables instantly during vMotion.

Key takeaway: Expired STS certificates and VLAN drift between racks cause most 'vCenter is broken' and 'vMotion broke my VM' tickets - check certificate expiry monthly and standardise port-group VLANs.