By default, the root account on the vCSA 5.5 expires 90 days after installation if you don’t change the password. If you don’t follow these steps, you’re going to find yourself in a panic in about a quarter 🙂 This is taken from the vCenter Server Appliance 5.5 root account locked out after password expiration VMware KB article.
The vCSA allows you to establish your own password expiration and warning email policies by using the Admin tab of the Virtual Appliance Management Interface (VAMI).
By default, the password expiration on the local root account in the vCSA is set to 90 days after the password has been changed. This typically occurs at first boot. If the password is not changed on installation, there is a 90-day period before expiration.
Email addresses configured in the Admin tab in the VAMI (https://IP_address:5480
 or https://VAMI_host_name:5480
) receive email notifications each day for seven days prior to password expiration. The email settings, such as relay SMTP server, are configured through the vSphere Client in the vCenter Server mail settings.