vpxd.certmgmt.mode
" on vCenter Server is set to "thumbprint
", please refer Change the ESXi Certificate Mode for more details.The CA certificates for the ESXi hosts might not be available in TRUSTED_ROOTS store of vCenter Server when "vpxd.certmgmt.mode"
is set to "thumbprint
" on vCenter Server. When try to export logs for the host attached to the VC using vSphere Client UI, internally envoy sidecar tries to verify the host certificate with the trusted root certificate and this operation fails. Due to this UI does not show a log tree (which helps the client to select log types need to be exported).
This is a known issue on vCenter Server 7.x & 8.x and currently there is no resolution.
Workaround:
To workaround the issue, perform any of below Options.
Option 1:
Export logs from the ESXi host directly rather than using vSphere Client UI.
Option 2:
vSphere UI will use the TRUSTED_ROOTS certificates store to trust the host certificates, this will work if the CA certificate that signed the ESX certificates are available in TRUSTED_ROOTS.
Publish the CA Certificates on vCenter Server by following below commands
Option 3:
Change the certificate mode (vpxd.certmgmt.mode) on vCenter Server to "vmca" or "custom" (with custom certificates listed in trusted_root certificates).
Important Note:
Sample PowerCLI script to refresh ESXi host certificates.
#To use this script, pipe hostnames to it.
#first step is to import it:
#> . c:\path\to\script.ps1
#> get-cluster | get-vmhost | foreach {$_.Name} | refreshcerts
function refreshcerts
{
Begin{
}
Process{
Write-host "Processing $_"
$hostid = Get-VMHost $_ | Get-View
$hostParam = New-Object VMware.Vim.ManagedObjectReference[] (1)
$hostParam[0] = New-Object VMware.Vim.ManagedObjectReference
$hostParam[0].value = $hostid.moref.value
$hostParam[0].type = 'HostSystem'
$_this = Get-View -Id 'CertificateManager-certificateManager'
$task = $_this.CertMgrRefreshCACertificatesAndCRLs_Task($hostParam)
Wait-Task -Task $task
$task = $_this.CertMgrRefreshCertificates_Task($hostParam)
Wait-Task -Task $task
}
End{
Start-Sleep -Seconds 10
Write-host "Done"
}
}