Replacing machine ssl certificate on vcsa 6.7 failed with error

Replacing machine ssl certificate with custom certificate on VCSA 6.7 failed with error
"Error certificate-manager 'lstool get' failed:1"

Description:
Replacing machine ssl certificate with custom certificate on VCSA 6.7 failed due to 3rd party plugins deployed/installed with no valid certificate

Cause:
The certificate replacement process will check whether the 3rd party plugins installed have valid certificate or not. If not, the certificate replace will get failed.

Resolution:
The only resolution is to skip the validation that is being carried out by certificate manager process

1. Navigate to directory
#cd /usr/lib/vmware/site-packages/cis/

2. Take a backup of certificatemanagerhelper. Py file

3. Open the file using vi editor and edit the following section
#to remove LsTools stdout
If(rc! =0) :
    logging.error("'lstool get' failed{}".format(rc))
Comment the line #raise exception("'lstool get' failed: %d" %rc) and instead TYPE rc=0

4. Keep the certificate and certificate chain ready

5. Replace the certificate

Replacing machine ssl certificates with custom certificates on VCSA 6.7 failed

Replacing machine ssl certificates with custom certificates on VCSA 6.7 failed

Description:
We have vcsa 6.7 deployed and vcsa HA configured. Active node runs in site A, whereas passive and witness node runs on site B. When we try to replace machine ssl certificate with custom cert, it got failed while trying to update cert on passive node

Resolution:
Replacing certificate on HA enabled vcsa cluster is not supported

The solution is to destroy vcsa HA first and then replace machine ssl certificate. Once done, enable VCSA HA and then complete the HA configuration.