SRM site pairing fails with Unknown SSL certificate error
search cancel

SRM site pairing fails with Unknown SSL certificate error

book

Article ID: 312683

calendar_today

Updated On:

Products

VMware Live Recovery VMware vCenter Server

Issue/Introduction

Symptoms: 

  • SRM site pairing fails with error: "The SSL Connection from #### to the remote host ####:443 has terminated. The remote host certificate has these problems: Unknown SSL certificate error". 
  • SRM GUI displays: Unable to connect to Site Recovery Manager Server... Reason: java.net.SocketTimeoutException: 30,000 milliseconds timeout.
  • Site pairing fails after replacing Machine SSL certificates in vCenter.
  • CA-signed certificate is installed on either the source or the destination vCenter
  • The vmware-dr.log (less /opt/vmware/support/logs/srm/vmware-dr.log) contains errors similar to

    2023-01-30T18:40:35.555Z warning vmware-dr[02656] [SRM@6876 sub=IO.Connection] Failed to SSL handshake; SSL(<io_obj      p:0x00007efbd8010d98, h:38, <TCP '##.##.##.## : 48042'>, <TCP '##.##.##.## : 443'>>), e: 336134278(certificate verify failed), duration: 15msec
    2023-01-30T18:40:35.555Z warning vmware-dr[02656] [SRM@6876 sub=HttpConnectionPool-000001] Failed to get pooled connection;  <cs p:00000000024fd7a0, TCP:vcenter.prod.org:443>, SSL(<io_obj p
    :0x00007efbd8010d98, h:38, <TCP '#### : 48042'>, <TCP '##.##.##.## : 443'>>), duration: 25msec,                               N7Vmacore3Ssl18SSLVerifyExceptionE(SSL Exception: Verification parameters:
     --> PeerThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
     --> ExpectedThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
     --> ExpectedPeerName: ####
     --> The remote host certificate has these problems:
     --> * unable to get local issuer certificate)
 

2026-08-07T05:13:17.126Z WARNING aps-service 23278 [ApsService@4413 sub="IO.Connection" opID="bc6a702c-b6d6-40f0-8420-fa09ca1d6f9a-probeConnection"] Failed to SSL handshake; SSL(<io_obj t:N7Vmacore6System19TCPSocketObjectAsioE, h:14, <TCP '##.##.##.## 45046'>, <TCP '##.##.##.## : 443'>>), e: 167772294(certificate verify failed (SSL routines)), duration: 23msec
2026-08-07T05:13:17.126Z WARNING aps-service 23278 [ApsService@4413 sub="ProbeSsl.Host.VmomiServer.SiteManager" opID="bc6a702c-b6d6-40f0-8420-fa09ca1d6f9a-probeConnection"] SSL client handshake to '####:443' failed

--> ExpectedCertificate:
--> ExpectedPeerName: ####
--> The remote host certificate has these problems:
2026-08-07T05:13:17.178Z WARNING aps-service 28942 [ApsService@4413 sub="Default" opID="bc6a702c-b6d6-40f0-8420-fa09ca1d6f9a-getServicesForPairing"] Unrecognized SSL certificate error flags: 0x0000000008000000

  • Verification of dr.log (less /opt/vmware/support/dr-client/dr.log) reports certificate unknown error. 

2023-01-30T18:40:35.564Z warning vmware-dr[02666] [SRM@6876 sub=RemoteSite.RemoteLkpServer connID=lkp-admin-2854] Failed to connect:
--> (dr.fault.CertificateNotTrustedByDr) {
-->    faultCause = (dr.fault.CertificateUnknownError) {
-->       faultCause = (vmodl.MethodFault) null,
-->       faultMessage = <unset>,
-->       name = "vSphereSRM2",
-->       uuid = "####",
-->       address = "vcenter.prod.org",
-->       port = "443",
-->       reason = (vmodl.MethodFault) null
-->       msg = ""
-->    },
-->    faultMessage = <unset>,
-->    name = "###",
-->    uuid = "####,
-->    address = "####",
-->    port = "443",
-->    reason = (vmodl.MethodFault) null
-->    msg = ""


2024-11-19T11:24:35.153-05:00 info vmware-dr[21897] [SRM@6876 sub=ServerSingletonCache] TranslateExnToFault: Failed to obtain MoRef/ServiceInstanceContent, context not available within timeout period
2024-11-19T11:24:35.153-05:00 error vmware-dr[21897] [SRM@6876 sub=RemoteSite] Failed to find service endpoints from remote LS++ 'https:/Broadcom.VMware.com/:443/lookupservice/sdk' with thumbprint '##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##', VC id '#######-###-###-####-####':
--> (dr.fault.ConnectionDownFault) {
-->    faultCause = (dr.fault.Timedout) {
-->       faultCause = (vmodl.MethodFault) null,
-->       faultMessage = <unset>,
-->       timeout = 300
-->       msg = ""
-->    },
-->    faultMessage = <unset>
-->    msg = ""
--> }
-->

Environment

Site Recovery Manager 8.x

VMware Live Recovery 9.x 

Cause

The SRM appliance's internal certificate store does not contain the current trusted root CA certificates required to validate the vCenter service endpoints. This commonly occurs if vCenter certificates have been updated or modified, and the SRM appliance has not been updated to trust the new certificate.

Resolution

Follow the instructions below to save certificates from vCenter Windows/Appliance & import into SRM appliance. 

1. Right click on Download trusted root CA certificates & Save Link as..
 


 
2. Extract the certs zip folder 
 

 

3.The required certificate format (Windows or Linux) depends on the target host operating system. The SRM appliance requires Linux certificates 

vCenter in Enhanced Link Mode (ELM) 

Using WinSCP copy the "lin" certificate folder to /home/admin/ directory in the SRM appliance.

 a. Login to SRM appliance as root and list the contents of /home/admin/

 root@srmpr [ /home/admin ]# ls

 lin

 b. Change directory to lin

 root@srmpr [ /home/admin ]# cd lin

 c. Copy all the files in folder ''lin" to /etc/ssl/certs/ directory by running the command cp *.* /etc/ssl/certs/ and follow the steps from 4.

         Independent vCenter (Not in linked mode)

          Using WinSCP create a folder called common under /home/admin in SRM appliance and copy the contents of both vCenters "lin" folder into the folder common folder.

          a. Login to SRM appliance as root and list the contents of /home/admin/

          root@srmpr [ /home/admin ]# ls

common 

b. Change directory to common

root@srmpr [ /home/admin ]# cd common

c. Copy all the files in folder ''common" to /etc/ssl/certs/ directory by running the command cp *.* /etc/ssl/certs/ and follow the steps from 4.

4. To modify the certificates' permissions, run the following command chmod a+r /etc/ssl/certs/*

5. Run - c_rehash

NOTE: c_rehash command does not exist in SRM 8.8 and higher versions. Run '/usr/bin/rehash_ca_certificates.sh'

6. Reboot the appliance 

7. Reconfigure the appliance 

8. Reconnect site pair. 


Workaround:

c_rehash scans directories and calculates a hash value of each .pem, .crt, .cer, or .crl file in the specified directory list and creates symbolic links for each file, where the name of the link is the hash value.


Additional Information

 



Powered by Wolken Software