diff --git a/inc/vCenter-SSL.ps1 b/inc/vCenter-SSL.ps1
index 861f4222..391d4767 100644
--- a/inc/vCenter-SSL.ps1
+++ b/inc/vCenter-SSL.ps1
@@ -1,6 +1,6 @@
 #!/usr/bin/env pwsh
 # -----------------------------------------------------------------------------------
-# vCenter + Posh-ACME Script using PowerCLI (TLS-safe, cross-platform)
+# vCenter + Posh-ACME Script using PowerCLI (TLS-safe, ACME fixed)
 # -----------------------------------------------------------------------------------
 
 . /opt/idssys/nodemgmt/conf/powerwall/settings.ps1
@@ -77,7 +77,7 @@ Import-Module Posh-ACME -ErrorAction Stop
 # ----------------------------
 $pArgs = @{
     PowerDNSApiHost    = $WDNSHOST
-    PowerDNSApiKey     = $PDNSAPI
+    PowerDNSApiKey     = $PDNSAPI   # Plain string, do NOT convert to SecureString
     PowerDNSUseTLS     = $true
     PowerDNSPort       = 443
     PowerDNSServerName = 'localhost'
@@ -143,12 +143,13 @@ if ($certSuccess) {
 }
 
 # ----------------------------
-# Restart vpxd service
+# Restart vpxd service via PowerCLI (safe)
 # ----------------------------
 try {
-    $uriRestart = "https://$VCENTERHOST/rest/appliance/system/services/vpxd?action=restart"
-    Invoke-RestMethod -Uri $uriRestart -Method Post -Headers $sessionHeaders -SkipCertificateCheck
-    Write-Host "vCenter vpxd service restart requested." -ForegroundColor Yellow
+    Write-Host "Restarting vpxd service..." -ForegroundColor Yellow
+    $service = Get-VMHostService -VMHost $VCENTERHOST | Where-Object { $_.Key -eq "vpxd" }
+    if ($service) { Restart-VMHostService -HostService $service -Confirm:$false }
+    Write-Host "vpxd service restart requested." -ForegroundColor Yellow
 } catch {
     Write-Host "Failed to restart vpxd service: $($_.Exception.Message)" -ForegroundColor Yellow
     $global:helpme = $_.Exception.Message