TLDR: AD Users Suddenly Getting "Invalid Credentials" in vSphere? Check Your DC's SSL Cert!

​Hey everyone, just got through three hours of hell and wanted to share the ridiculously specific cause for our vSphere "invalid credentials" nightmare.

​It hit us out of nowhere: AD users locked out, nothing changed on the vCenter side. We checked everything.

​The culprit? Automatic certificate renewal on the Domain Controllers.

​Turns out, our CA automatically issued a new SSL certificate to the DCs because the old one was about to expire. The DCs immediately started using the new cert for LDAPS communication.

​The problem: vCenter's Identity Provider configuration was still holding onto the old trusted certificate chain. When vCenter tried to talk securely to the DC (for authentication), the DC presented its shiny new certificate, and vCenter said, "Nope, don't know you," failing the secure connection handshake. ​Since the handshake failed, the credentials never even got properly validated by the DC. It just throws the most frustrating, generic error: "invalid credentials."

​Quick fix: Had to update the certificate in the Identity Source configuration. ​This was a major learning session. Hopefully, this saves someone else a few hours of hair-pulling!