SRM/VR - Server certificate assertion not verified and thumbprint not matched

Products

• VMware Live Recovery
• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• Unable to reconfigure SRM after upgrade.
  
  
• Unable to access or view the Site Recovery Manager (SRM) plugin from the vCenter Server UI.
  
  
• The "Site Recovery" icon/plugin is missing or inaccessible.
• Attempting to connect or reconfigure results in the error: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate assertion not verified and thumbprint not matched

• Unable to create a new site pair - 

Error:
Failed to retrieve pairs from extension server at https://srm.vmware.local:443/drserver/vcdr/vmomi/sdk.
Failed to connect to Site Recovery Manager Server at https://srm.vmware.local:443/drserver/vcdr/vmomi/sdk. 
Reason: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate assertion not verified and thumbprint not matched 
Failed to connect to Site Recovery Manager Server at https://srm.vmware.local:443/drserver/vcdr/vmomi/sdk. 
Reason: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate assertion not verified and thumbprint not matched
Operation ID: e53a538a-bf3a-4612-b5fe-771aa92dc629

• Unable to reconnect VR site pairs.
  
  Error :
Failed to connect to HBR Management Server at https://####:8043. Reason: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate assertion not verified and thumbprint not matched 
Server certificate assertion not verified and thumbprint not matched
Certificate for <####> doesn't match common name of the certificate subject: ####

Operation ID: d26e635b

• Aria operations complaining about SRM certificate assertion not verified and thumbprint not matched error.
  
  

Environment

• VMware vSphere Replication 8.x / 9.x
• VMware Site Recovery Manager 8.x / 9.x
• VMware vCenter Server 7.x / 8.x

Cause

1. This issue occurs when the SRM or VR appliance is registered with the vCenter Server using an IP address or a short name, while the vCenter SSL certificate is issued to the Fully Qualified Domain Name (FQDN).
   This creates a thumbprint mismatch during the certificate assertion process.
   
   
2. DNS is not configured or incorrectly set for vCenter, SRM & VR appliances

This may also be caused during deployment of the OVF when the hostname is not changed as per the correct DNS record name.

Resolution

The below steps can be applied to both SRM & vSphere replication. 

1. Ensure forward and reverse lookup records are created in DNS for the appliance. Verify it by running the nslookup command against the IP & FQDN 

root@srm [ ~ ]# hostname
srm

root@srm [ ~ ]# netmgr hostname --set --name srm.vmware.local 
root@srm [ ~ ]# netmgr hostname --get
Hostname: srm.vmware.local

Photon Network Manager Commands to update Hostname/IP Address/DNS in SRM & vSphere replication

2. Change the SRM Appliance Certificate from VAMI to reflect FQDN 

Refer: Change the VMware Live Site Recovery Appliance Certificate

3. Reconfigure SRM & reconnect site pair 

NOTE: We always recommend using a DNS server. In the absence of a DNS server, assign the appliance certificate to IP address and register it using IP address.

If the above steps do not resolve the issue then try the following:

 

Note: Take snapshots of the vCenter Server, SRM, and VR appliances before proceeding.

1. Verify that forward and reverse DNS lookup records exist for the vCenter, SRM, and VR appliances.
2. Log in to the Site Recovery Manager Appliance Management Interface (VAMI) at https://<SRM-IP>:5480 as admin.
3. Navigate to Summary and click Reconfigure.
4. On the Platform Services Controller page, locate the PSC host name field.
5. Change the IP address to the vCenter Server FQDN.
6. Complete the reconfiguration wizard.
7. Repeat these steps for the vSphere Replication Appliance VAMI at https://<VR-IP>:5480.
8. Log out and log back into the vCenter Server UI to verify the Site Recovery plugin is visible.

If the issue persists, ensure the appliance hostnames are set to FQDNs using the network manager: netmgr hostname --set --name <Appliance.FQDN>

Refer: Reconfigure the VMware Live Site Recovery Appliance