You might see Invalid credentials, delaying next attempt in VMware when the ESXi host, which is part of a vSphere environment managed by vCenter, loses its connection to vCenter or cannot authenticate ...

So I have a vCenter with two hosts that all live on a private management network. The vCenter is running its self-signed stuff. I wanted to replace them with real certs from my CA. It was already fun ...