The warnings persist because the issuing certificate chain , not the renewed leaf certificates, is approaching expiration. VCF Operations Fleet Management can view certificate details and certificate alerts across VCF Management and VCF Instance components, including vCenter, NSX Manager, SDDC Manager, ESX, and VCF Operations components . Auto-renewal only renews supported component TLS certificates and occurs 60 days before certificate expiration; it does not renew root certificates . When certificates are issued by an enterprise Microsoft CA, the validity of endpoint certificates is constrained by the validity of the issuing chain. vSphere documentation states that a certificate cannot be renewed with an expiration date beyond the expiration of the trusted root certificate . Therefore, even if the component certificates were recently rotated and the template is configured for one year, the generated certificates may still inherit a shorter effective validity period if the Microsoft CA root or intermediate certificate is expiring soon. The correct remediation is to renew or replace the CA chain, not repeatedly clear alerts or manually renew endpoint certificates. Reference topic: Objective 4.14 – Fleet Management / Certificate Management / Auto-Renewal / CA Chain Validity .