vCenter Server upgrade pre-check shows below error message:Verification of the machine SSL certificate failed due to an invalid trusted root certificate chain. ERROR: ['unable to get issuer certificate']. Unable to find the root certificate with the subject '<X509Name object '/C=##/ST=#####/L=#####/O=######.###, ###./CN=#######'>'
VMware vCenter Server 8.x
Resolving a Missing CA Certificate:
Unable to find the root certificate with the subject 'X509Name object '/C=US/ST=#####/L=#####/O=######.com, Inc./CN=#######''vCert Script: vCertvCert script and navigate to Option 3, Manage certificates > Option 3. CA certificates in VMware Directory > Publish CA certificate(s) to VMware Directory.Note: Make sure to include the complete certificate chain of the signing certificate.
For example, if the certificate chain consists of the Machine SSL Certificate, Intermediate CA Certificate(s), and Root CA Certificate, and only the Root CA Certificate is missing, create the certificate chain in the following order:
-----BEGIN CERTIFICATE-----<alphanumeric certificate characters> <----- Intermediate Certificate-----END CERTIFICATE----------BEGIN CERTIFICATE-----<alphanumeric certificate characters> <----- Root Certificate-----END CERTIFICATE-----
To fix a MACHINE_SSL_CERT store that contains incorrect trusted roots or is missing the trusted root certificate in the chain:
Note: Take a snapshot of the vCenter before performing this activity. If the vCenter is in linked mode, take offline snapshots of all the linked vCenter together. Refer: Snapshot Best practices for vCenter Server Virtual Machines
MACHINE_SSL_CERT store: /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /var/tmp/machine_ssl.crt /usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /var/tmp/machine_ssl.key /var/tmp/machine_ssl.crt) in a text editor and append the intermediate and root certificates. The file must contain the complete chain in the exact order below: /usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CERT -y /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store MACHINE_SSL_CERT --alias __MACHINE_CERT --cert /var/tmp/machine_ssl.crt --key /var/tmp/machine_ssl.key /usr/lib/vmware-vmafd/bin/vecs-cli force-refreshservice-control --stop --all && service-control --start --allSample steps to export the CA Certificate from local Windows Desktop:
Note: This is just an example to show how to export CA certificate from the Certificate Path based on issuer name ("Go Daddy Root Certificate Authority - G2" in this example).
Certificate Path tab, select the CA certificate to export and Click on View Certificate.Details tab of the CA Certificate and click on Copy to File.Next on the new window to export the Certificate.Base-64 encoded X.509 (.CER).Filename for the exported CA certificate and Click Next.Finish to save the Certificate