An ESXi host’s VMCA-Signed certificate has expired. How can the certificate be renewed?

A.
In the vSphere Web Client, browse to the host in question. Click the Manage tab and select settings. Select
System and click Certificate, then click the Renew button.

B.
In the vSphere Web Client, browse to the host in question. Click the Manage tab and select settings. Select
System and click Certificate, then click the Refresh CA Certificates button.

C.
Run the command /sbin/generate-certificates on the affected host.

D.
Disconnect the host from vCenter Server and reconnect it.

Explanation:
You can renew your certificates when they are about to expire, or if you want to provision the host with a new
certificate for other reasons. If the certificate is already expired, you must disconnect the host and
reconnect it.
https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.security.doc/GUIDECFD1A29-0534-4118-B762-967A113D5CAA.html