Error: 'Connection to VCSP server failed” when attempting a Content Library sync
search cancel

Error: 'Connection to VCSP server failed” when attempting a Content Library sync

book

Article ID: 301478

calendar_today

Updated On:

Products

VMware vCenter Server 7.0 VMware vCenter Server 8.0

Issue/Introduction

  • When a sync is performed on a subscribed library, it will fail.
  • While performing a manual or automatic sync this error message is encountered in the vSphere Client:
Error:  A specified parameter was not correct: Connection to VCSP server vcenter-fqdn
  • In the cls.log on the vCenter one of the the following errors might be reported:
ERROR    | cls-simple-activity-1     | VcspClientImpl                 | Connect to VCSP server failed with bad request error HTTP/1.0 502 Bad Gateway
ERROR   | null   | cls-simple-activity-   | VcspClientImpl | Connect to VCSP server failed with bad request error HTTP/1.1 407 Proxy Authentication Required
  • On the Proxy Server errors similar to these might be received: 
<html>
<head>
<title>Denied Access Policy </title>
<meta name="author" content="Example Company">
<meta name="description" content="Denied Access Policy">
</head>
<body>
<center>
<img src=http://fqdn/images/group/g2/logo.jpg>
<p>
<font face="Arial, Helvetica, sans-serif" size="4" color="Red"><b>You are about to access the Internet from the Example Company Network
<p>
<font face="Arial, Helvetica, sans-serif" size="4" color="Red">INTERNET USAGE IS MONITORED AND LOGGED.</font>
<p>
<font face="Arial, Helvetica, sans-serif" size="3" color="Red"><b> Your IP address: ##.##.##.##
<br>Your username: Example.Username</b></font>
<p>
<font face="Arial, Helvetica, sans-serif" size="4" color="Red">YOU HAVE ENTERED AN INCORRECT USER NAME OR PASSWORD.
<p>
  • A curl command test from the vCenter to the proxy URL fails and returns output similar to the following:
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate

Environment

VMware vCenter Server

Cause

  • Synchronization will be unsuccessful due to failed proxy authentication. This can be due to issues with the proxy server, or the proxy configuration.
  • If a proxy has been enabled on vCenter but one is not configured in the environment this can also cause the sync to fail.

Resolution

Steps to check the proxy configuration on vCenter Server:

  1. Go to vCenter Server VAMI web page.
    1. Example: https://vCenter-IP-or-FQDN:5480
  2. Go to Networking and Select Edit next to Proxy Settings
  3. Follow the steps below to correct or remove the Proxy Settings.

If a proxy has been configured and should be in use, confirm the settings are correct for vCenter:

  1. Open the Edit Proxy Settings page.
  2. Confirm the correct URL, Port, and Username have been entered. 
  3. Ensure the Proxy Server is powered on, and accepting log ins with the configured User account.
  4. If the Proxy Server is not accepting log ins with the configured User account follow these steps to recover:
    1. Connect to the proxy server with an administrator account.
    2. Reset the password configured for vCenter
  5. Once the settings or account have been corrected sync the Content Library again.

If a proxy is showing configured but should not be in use, follow these steps to disable the configuration:

  1. Open the Edit Proxy Settings page. See steps 1 and 2 above.
  2. Uncheck the options for FTP, HTTPS, and HTTP. They should now show Deactivated or Disabled depending on the vCenter Server version.
  3. Save the window.
  4. Confirm the Proxy Settings have been disabled and resync the Content Library.

For vCenter 7.0:

For vCenter 8.0:

Ensure that the proxy certificate chain is uploaded to the vCenter in the trusted root store:

Use the vCenter UI to upload the cert using the steps in this Technical Document or perform the following steps from the CLI:

  1. Export the Root/Intermediate CA certificates from the proxy in Base64/PEM format.
  2. Upload the certificate chain to the /tmp directory on the source vCenter.
  3. Publish the certificate to the trusted store: /usr/lib/vmware-vmafd/bin/dir-cli trustedcert publish --cert /tmp/[PROXY_CA].pem
  4. Refresh the certificate store: /usr/lib/vmware-vmafd/bin/vecs-cli force-refresh

Additional Information

Powered by Wolken Software