By default, vCenter Server notifies you 30 days before your Key Management Server (KMS) certificates expire. You can change this default value.

KMS certificates have an expiration date. When the threshold for the expiration date is reached, an alarm notifies you.

vCenter Server and key providers exchange two types of certificates: server and client. The VMware Endpoint Certificate Store (VECS) on the vCenter Server system stores the server certificates and one client certificate per key provider. Because there are two certificate types, there are two alarms for each certificate type (one for client, one for server).


  1. Log in to a vCenter Server system by using the vSphere Client.
  2. Select the vCenter Server system in the object hierarchy.
  3. Click Configure.
  4. Under Settings, click Advanced Settings, and click Edit Settings.
  5. Click the Filter icon and enter vpxd.kmscert.threshold, or scroll to the configuration parameter itself.
  6. Enter your value in days and click Save.