Checked the logs... the errors don't tell you anything useful:
ERROR certificate-manager <date> <Time> Updating certificate for "com.vmware.vim.eam" extension
ERROR certificate-manager <date> <Time> Updating certificate for "com.vmware.rbd" extension
ERROR certificate-manager <date> <Time> Updating certificate for "com.vmware.imagebuilder" extension
Then there is:
ERROR certificate-manager {
"translatable" : "An error occurred while invoking external command : '%(0)s'"
"localized" : "An error occurred while invoking external command: 'None'"
"Error while starting services, please see service-control log for more details"
I'm not certain where the service-control.log is, as it's not showing up in any of the KBBs for vCenter logs (6.x). Humph.