vCenter No Healthy Upstream: Certificate Checks I Do First

No healthy upstream on a vCenter login page is not always a networking problem. In many cases, vCenter services are down behind the reverse proxy. One common reason is expired certificates.

Symptoms that point toward certificates

• vSphere Client shows no healthy upstream.
• 503 Service Unavailable appears when opening vCenter.
• Login spins and never completes.
• VAMI reports certificate verification failed.
• vpxd or vpxd-svcs fails after reboot.

Do not skip backup

If you can access VAMI, confirm file-based backup. If you need a snapshot, use a powered-off snapshot from the ESXi host when possible.

Check VECS expiration

for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do
  echo "[*] Store: $store"
  /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store "$store" --text | grep -ie "Alias" -ie "Not After"
done

Reference

Based on Broadcom KB Article ID 344201, no healthy upstream or 503 Service Unavailable when accessing vCenter Server.