Hosts randomly disconnect from vCenter server after being reconnected.

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• Hosts become disconnected at random times after being successfully reconnected.
• After host disconnects, in the vCenter Server C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd.log you see messages similar to:
  
  [yyyy-mm-dd hh:mm:ss.827 F5725B90 error 'App'] SSLStreamImpl::BIORead (5F3A2F68) timed out
  [yyyy-mm-dd hh:mm:ss.827 F5725B90 error 'App'] SSLStreamImpl::DoServerHandshake (5F3A2F68) SSL_accept failed with BIO Error
  [yyyy-mm-dd hh:mm:ss.828 F5725B90 warning 'Proxysvc'] SSL Handshake timedout for stream 'IP address', blacklisting it for 3000 ms
  
  
• EVENT ID 8 is logged in the Event Log on vCenter:
  
  Message 1
  Event Type: Error
  Event Source: crypt32
  Event Category: None
  Event ID: 8
  Date: date
  Time: time
  User: user name
  Computer: computer name
  Description:
  Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
  For more information, see Help and Support Center at http://support.microsoft.com.
  
  Message 2
  Event Type: Error
  Event Source: crypt32
  Event Category: None
  Event ID: 8
  Date: date
  Time: time
  User: user name
  Computer: computer name
  Description:
  Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.
  For more information, see Help and Support Center at http://support.microsoft.com.

Environment

VMware vCenter Server 4.1.x
VMware vCenter Server 5.5.x
VMware vCenter Server 5.1.x
VMware vCenter Server 4.0.x
VMware vCenter Server 5.0.x

Cause

This behavior can occur if the Update Root Certificates component is turned on and the computer cannot connect to the Windows Update server on the Internet. The Update Root Certificates component automatically updates trusted root-certificate authorities from the Microsoft Update server at regular intervals.

Resolution

To resolve this behavior, you must either connect to the Internet or turn off the Update Root Certificates component.

To turn off the Update Root Certificates component:

1. Log into vCenter Server.
2. Click Start > Settings > Control Panel > Add or Remove Programs.
3. Click Add/Remove Windows Components.
4. Deselect the Update Root Certificates checkbox, click Next, then Finish.

On Windows 2008 R2, turn off Automatic Root Certificates Update:

Note: To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

To turn off Automatic Root Certificates Update:

1. Click Start > Run, type gpedit.msc, and click OK.
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and click Continue.
3. Double-click Administrative Templates > System > Internet Communication Management, and click Internet Communication settings.
4. Double-click Turn off Automatic Root Certificates Update, click Enabled, and click OK.
5. Close the Local Group Policy Editor.

For more information, see Event ID 8 — Automatic Root Certificates Update Configuration.

Additional Information

For information on how to turn off Automatic Root Certificates Update on Windows Server 2008, see http://technet.microsoft.com/en-us/library/cc734054%28v=ws.10%29.aspx