look at the last comment here
https://communities.vmware.com/t5/vCenter-Server-Discussions/VCSA-6-7-vpxd-doesn-t-start-after-repla...
you can run this
for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done
to see if any of the trusted roots are expired, if so there is semi complicated process in removing them.
