SDDC Precheck failure with Error when getting VIM Client for ESXi host with id - xxxxxxxxxxxxx

Products

• VMware Cloud Foundation

Issue/Introduction

• SDDC Manager precheck error at ESXi VIM Connection

  Error when getting VIM client for ESX host with id . xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx8271

• Error in /var/log/vmware/vcf/operationsmanager/operationsmanager.log

  ERROR [vcf_om, df87fa297afc908d, cfdf] [c.v.e.s.c.c.v.vsphere. VaphereClient, om-exec-22] Failed to connect to https://esxi-example.com:443/sdk
  com.vmware.vim.vmomi.client.exception.SslException:javax.net.991.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPah.BuilderException: unable to find valid certification path to requested target

Cause

The following can be 2 of the multiple reasons for the ESXI VIM connection precheck error in SDDC

• SDDC Manager is unable to validate the certificate chain for the host
• The vCenter certificate has changed outside of SDDC and the SDDC Manager is still referencing the old root certificate.

Resolution

1. Check vCenter certificate status
   1. SSH to vCenter with root
   2. Run the below command

      for store in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list | grep -v TRUSTED_ROOT_CRLS); do echo "[*] Store :" $store; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $store --text | grep -ie "Alias" -ie "Not After";done;

2. If vCenter server certificate was expired and renewed outside of SDDC then import the root certificate of vCenter server in SDDC - refer How to import the vCenter root certificate into the SDDC manager TrustStore
3. Re-run the precheck from SDDC Manager