Actually the expired certificate was not STS signing certificate but host certificate.  Solved by renewing host certificates for both hosts. This should be done every 5 years before they expire.

What i have done to fix it :

• In the vSphere Web Client (SSO local admin account), click on vcenter inventory list then click on  hosts.
• Select the host showing alarm 
• Click the Manage tab and click Settings
• in left menu, under System item, click Certificate.
• Click on the button to renew the certificates.
• Wait while task finish progressing !

I hope that this  will help someone else in future 🙂