After changing the expired certificate VMware vSphere Web Client fails to display the VMware vCenter Server inventory
search cancel

After changing the expired certificate VMware vSphere Web Client fails to display the VMware vCenter Server inventory

book

Article ID: 305848

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

Symptoms:
  • Objects such as hosts or virtual machines are not displayed in the VMware vSphere Web Client.
  • Objects are displayed on VMware vSphere client.
  • In the vSphere_client_virgo.log located at Web Client Server log, you see error similar to:


    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3com.vmware.vsphere.client.security.VcDirectory Reading VcDirectory file on the disk.
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3com.vmware.vsphere.client.security.VcDirectory VcDirectory file not found.
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3com.vmware.vsphere.client.security.VcDirectory No data in VcDirectory file.
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3com.vmware.vsphere.client.security.VcDirectory No vc's found in the directory.
    <YYYY-MM-DD><time> WARN[WARN]http-bio-443-exec-3com.vmware.vise.data.query.impl.ResultDirectory Type cannot be resolved for ManagedObjectReference: type = VcDirectory, value = VcDirectory, serverGuid = VcDirectory
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vise.util.i18n.I18nFilter The preferred locale for session 1C2CDD8D4C105150582CEFD7C0857048 is set to: de_AT
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vise.security.DefaultAuthenticationProvider Authenticating user: admin@system-domain using authentication handler: $Proxy359
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vise.vim.security.sso.impl.SsoUtilInternal Acquiring a SAML token for user admin@system-domain from https://vCenter.domain.com:7444/ims/STSService?wsdl
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vim.sso.client.impl.SamlTokenImpl SAML token for subject {Name: admin, Domain: System-Domain} successfully parsed from Element
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl Successfully acquired token for user: admin@system-domain
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.sso.SsoAuthenticationHandler SSO authentication successful for session : 1C2CDD8D4C105150582CEFD7C0857048
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vise.security.DefaultAuthenticationProvider Authenticating user: admin@system-domain using authentication handler: $Proxy359
    <YYYY-MM-DD><time> INFO[INFO]http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.VimAuthenticationHandler Logging in to LinkedVcGroupRegistry for session 1C2CDD8D4C105150582CEFD7C0857048
    <YYYY-MM-DD><time> INFO [INFO ] http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.VcDirectory Reading VcDirectory file on the disk.
    <YYYY-MM-DD><time> INFO [INFO ] http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.VcDirectory VcDirectory file not found.
    <YYYY-MM-DD><time> INFO [INFO ] http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.VcDirectory No data in VcDirectory file.
    <YYYY-MM-DD><time> INFO [INFO ] http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.VcDirectory No vc's found in the directory.
    <YYYY-MM-DD><time> ERROR [ERROR] http-bio-443-exec-3 1C2CDD8D4C105150582CEFD7C0857048 com.vmware.vsphere.client.security.VimAuthenticationHandler Error when fetching vc's from LookupService. com.vmware.vim.binding.vmodl.fault.InvalidArgument: null
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
    </time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time>

  • Running ssolscli.cmd listServices https://FQDN:7444/lookupservice/sdk to list the services registered with SSO reports the error:

    Return code 100: OperationFailed



Environment

VMware vCenter Server 5.1.x

Cause

This issue occurs when the expired VMware vCenter Single Sign-On (SS0) Service ID and Service End Point from the SSO Database are not removed, after re-registering vCenter Server with new certificate.

Resolution

To resolve the issue, remove the old vCenter Server instance from the Single Sign-On database.

To remove the old vCenter Server instance from the SSO database:

  1. Identify the current vCenter Server instance in the vpxd.cfg file located at C:\ProgramData\VMware\VMware VirtualCenter.
  2. Open vpxd.cfg file using text editor. You can see the current vCenter Server instance ID and name:

    <lookupService>
    <serviceId>{9300C2AC-4D97-4191-8EB1-387D9823E6E3}:23</serviceId>
    </lookupService>


    Note: Take a backup of the RSA (Single sign on) database before editing.
  3. Stop the vCenter Single Sign-on service (SSO).
  4. Log in to the SQL Management Studio and go to the RSA (SSO) database.
  5. Expand Tables.
  6. Right-click LS_SERVICE_ENDPOINT table and click Edit Top 200 Rows.

    In the last column you see the service ID, look for the two entries associated to vCenter Server.

    For example:

    {9300C2AC-4D97-4191-8EB1-387D9823E6E3}:23

    20     https://VC.DOMAIN.com:443/sdk <Binary data> 0 19
    23     https://VC.DOMAIN.com:443/sdk <Binary data> 0 23

  7. Right-click and delete the row with old value ( row 1 in the above example).
  8. Expand Tables.
  9. Right-click LS_SERVICE table and click Edit Top 200 Rows.

    In the first column you see the service ID, look for the two entries associated to vCenter Server.

    For example:

    19 vCenterServer_2013.01.15_092833@System-Domain 5.1 vCenter Server vCenterService urn:vc NULL
    23 vCenterServer_2014.07.09_165913@System-Domain     5.1 vCenter Server vCenterService urn:vc NULL

  10. Right-click and delete the row with the old ID.
  11. Start the vCenter Single Sign-on service (SSO) service and login in to the Web Client to test if the issue is resolved.


Additional Information

有効期限の切れた証明書を変更すると、VMware vSphere Web Client で VMware vCenter Server のインベントリが表示されなくなる

Powered by Wolken Software