Pre-check error message "Verification of the machine SSL certificate failed due to an invalid trusted root certificate chain" during vCenter Server upgrade/ update
Article ID: 312124
Updated On:
Products
Issue/Introduction
vCenter Server upgrade pre-check shows below error message
Verification of the machine SSL certificate failed due to an invalid trusted root certificate chain. ERROR: [2, 2, 'unable to get issuer certificate'] . Unable to find the root certificate with the subject '<X509Name object '/C=US/ST=#####/L=#####/O=######.com, Inc./CN=#######'>'
Environment
VMware vCenter Server
Cause
An Incomplete Certificate Chain: The Machine SSL certificate chain is invalid or missing intermediate certificates on the Machine_SSL_Cert store or Trusted_roots store
A PNID Mismatch: There is an mismatch with the Primary Network Identifier (PNID) and hostname in the vCenter. Addressing vCenter FQDN and Hostname Case Mismatches
Understanding the Certificate Chain of Trust
To successfully verify a certificate, the entire chain of trust must be present. Below is an example of a complete hierarchy using multiple intermediate CA certificates:
- Machine SSL Certificate (Signed by Intermediate Certificate B)
- Intermediate Certificate B (Signed by Intermediate Certificate C)
- Intermediate Certificate C (Signed by Root Certificate)
- Root Certificate (Self-signed trust anchor)
Why Verification Fails: If any certificate in this hierarchy is missing from the chain (whether it is Certificate B, Certificate C, or the Root Certificate), the chain of trust is broken, and certificate verification will fail.
Resolution
To fix the missing chain in the vCenter server's machine_ssl_certificate.
Resolving a Missing CA Certificate :
To resolve a missing CA certificate issue, you must import the missing certificate into the TRUSTED_ROOTS store on the vCenter Server.
You can identify the missing certificate by reviewing the pre-check error, which will display the subject of the missing CA certificate. It will look similar to this:
Unable to find the root certificate with the subject 'X509Name object '/C=US/ST=#####/L=#####/O=####
##.com, Inc./CN=#######''
Methods to Import the Certificate:
You can import the missing certificate using any of the following three methods:
- Using vSphere Client : Add a Trusted Root Certificate to the Certificate Store
- Using CLI Utility : Add new certificates to the TRUSTED_ROOTS store via CLI
- Using vCert Script - vCert
- Option 3. Manage certificates > Option 3. CA certificates in VMware Directory > Publish CA certificate(s) to VMware Directory
Fixing MACHINE_SSL_CERT store that contains the wrong trusted roots or is missing the trusted roots certificate in the chain.
1. Extract the current certificate from the machine_ssl
/usr/lib/vmware-vmafd/bin/
2. Extract the current private key:
/usr/lib/vmware-vmafd/bin/
3. Build the complete certificate chain. Refer to: How to correctly chain custom root/intermediate SSL certificates to import into vCenter
Open the extracted certificate file (/var/tmp/machine_ssl.crt) in a text editor and append the intermediate and root certificates. The file must contain the complete chain in the correct order:
- Machine SSL Certificate
- Intermediate CA Certificate(s)
- Root CA Certificate
4. Delete the existing Machine SSL entry:
/usr/lib/vmware-vmafd/bin/
5. Add the entry back using the updated full chain:
/usr/lib/vmware-vmafd/bin/
6. Restart the vCenter Server services to apply the changes.
service-control --stop --all && service-control --start --all
7.To resolve the missing PNID issue, the Machine SSL certificate will need to be regenerated. Making sure the subject alternative name of the Machine SSL certificate contains the exact case of the current PNID of vCenter which can be found by running this command: /usr/lib/vmware-vmafd/bin/
The certificate can be regenerated using vCert, options 3. Manage certificates, then 1. Machine SSL certificate.
8. Re-run the upgrade post making these changes.
Additional Information
Sample steps to export the CA Certificate from local Windows Desktop:
Note: This is just an example to show how to export CA certificate from the Certificate Path based on issuer name ("Go Daddy Root Certificate Authority - G2" in this example).
- Open the Machine SSL of Certificate of vCenter Server from local Windows Desktop
- Click on Certificate Path tab, select the CA certificate to export and Click on View Certificate
- New window will open for the select CA certificate from the Certificate Path
- Select the Details tab of the CA Certificate and click on Copy to File
- Click Next on the new window to export the Certificate
- Select Base-64 encoded X.509 (.CER)
- Enter the Filename for the exported CA certificate and Click Next
- Click Finish to save the Certificate
Feedback
