look at the last comment here

https://communities.vmware.com/t5/vCenter-Server-Discussions/VCSA-6-7-vpxd-doesn-t-start-after-repla...

you can run this 

for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done

to see if any of the trusted roots are expired, if so there is semi complicated process in removing them.