I eventually found solution
Set "Toggle certificate setting" to ON from web UI or by creating file:
vcenter:~ # touch /etc/vmware-vpx/ssl/allow_regeneration
Stop all vmware-* services except vmware tools or switch to runlevel 2:
vcenter:~ # init 2
This will trigger same bash function that creates certificates on reboot with "Toggle certificate setting" ON:
vcenter:~ # source vpxd_commonutils; regenerate_certificates
script checks if existing certificate is self signed and if you have different hostname than specified in cert.
If you want to regenerate certificates without checking:
vcenter:~ # source vpxd_commonutils; generate_all_certificates replace
scripts MUST end with VC_CFG_RESULT=0, if not, check if vmware services are stopped
Set "Toggle certificate setting" to OFF or:
vcenter:~ # rm /etc/vmware-vpx/ssl/allow_regeneration
vcenter:~ # reboot