Issue
Use this article to troubleshoot validity-period limits for ZSphere self-signed certificates.
Symptoms
- A longer validity period is required for a self-signed certificate.
- Platform certificate management currently allows validity periods only within the supported product range.
Environment
- Product: ZVF
- Version: 4.x
- Component: ZSphere
- Affected object: certificate management
- Scenario: Security and certificate issues. Confirm the current version, deployment topology, storage type, and operation timeline.
Possible causes
- Current product certificate-management capabilities limit the maximum validity period for self-signed certificates.
- Compliance requirements differ from the product default capabilities.
- Manually replacing certificates can cause trust-chain exceptions for the UI, API, or migration tools.
Resolution
Perform the following checks in sequence, and record the affected objects, occurrence time, complete error messages, and current state.
- Confirm the current certificate type, whether it is self-signed or issued by an external CA, and the applicable compliance requirements.
- Prefer the managed entry in System Management > Certificate Management to generate or import a certificate.
- If a validity period beyond the product-supported range is required, first confirm version capability or requirement boundaries. Manual certificate replacement without confirmation is not recommended.
- After replacing a certificate, verify the trust state of the UI, API, migration tools, and browser.
Remediation
- Prefer the Certificate Management entry in System Management to generate or import a certificate that meets the current validity-period requirement.
- For validity periods beyond the product-supported boundary, use an external CA certificate or contact ZStack technical support to confirm the supported approach. Do not manually replace the system certificate.
Verification
- The certificate issuer, validity period, and domain name match expectations.
- The UI, API, migration tools, and browser can establish trusted connections normally.