Reconfiguring the Lookup Service Details fails to connect to the Lookup service address in Cloud Director Availability 4.x

Products

• VMware Cloud Director

Issue/Introduction

• Reconfiguring the vCenter Server Lookup service on a Cloud Director Availability appliance fails and you see a similar error:

Cannot connect to Lookup Service at 'https://PSC_FQDN:443/lookupservice/sdk'. Make sure the address is correct and accessible.

Environment

VMware Cloud Director Availability 4.x

Cause

This issue can occur when the machine SSL certificate for the SSO service differs from the certificate stored in the vCenter Server Lookup service.

Resolution

To verify you are encountering vCenter/lookup service certificate issues, perform the following checks:

Warning: Incorrectly updating certificate information of service registrations may break the functionality of that service.

1. SSH to the Platform Services Controller and log in as root.
2. Use the lstool script to get a list of the registered services on the PSC:

vSphere 6.x:
/usr/lib/vmidentity/tools/scripts/lstool.py list --url http://localhost:7080/lookupservice/sdk > /tmp/services.txt

vSphere 7.0:
/usr/lib/vmware-lookupsvc/tools/lstool.py list --url http://localhost:7090/lookupservice/sdk > /tmp/services.txt

3. Open the services.txt file and search for the following section:

Service Type: cs.identity

4. Take note of the endpoint certificate for the service.
5. Run the following command against the PSC:

openssl s_client -connect PSC_FQDN:443  < /dev/null 2>/dev/null | openssl x509

6. Compare the certificates from steps 4 and 5 to determine if there is a mismatch.

To resolve any certificate mismatch issues, contact Broadcom Support and note this Article ID (315010) in the problem description. For more information, see Creating and managing Broadcom support cases.