Renewing Certificates Using certificate-manager Fails with VMCAAddRootCertificatePrivate() failedError: 5, Failed to Add Root Certificate

Products

• VMware vCenter Server

Issue/Introduction

• Renewing Certificates Using Certificate Manager Fails with 

  VMCAAddRootCertificatePrivate() failedError: 5, Failed to Add Root Certificate

• Unable to renew certificates with certificate manager.
• You see  the following error in the log "/var/log/vmware/vmcad/certificate-manager.log":

  YYYY-MM-DDTHH:MM:SS INFO certificate-manager Command output :-
  Using config file : /var/tmp/vmware/MACHINE_SSL_CERT.cfg
  Error: 5, VMCAGetSignedCertificatePrivate() failedStatus : Failed
  Error Code : 5
  Error Message : Operation failed with error = ERROR_ACCESS_DENIED (5)
  
  YYYY-MM-DDTHH:MM:SS ERROR certificate-manager Using config file : /var/tmp/vmware/MACHINE_SSL_CERT.cfg
  Error: 5, VMCAGetSignedCertificatePrivate() failedStatus : Failed
  Error Code : 5
  Error Message : Operation failed with error = ERROR_ACCESS_DENIED (5)
  
  YYYY-MM-DDTHH:MM:SS ERROR certificate-manager Error while replacing Machine SSL Cert, please see /var/log/vmware/vmcad/certificate-manager.log for more information.
  YYYY-MM-DDTHH:MM:SS ERROR certificate-manager {
      "detail": [
          {
              "id": "install.ciscommon.command.errinvoke",
              "translatable": "An error occurred while invoking external command : '%(0)s'",
              "args": [
                  "Using config file : /var/tmp/vmware/MACHINE_SSL_CERT.cfg\nError: 5, VMCAGetSignedCertificatePrivate() failedStatus : Failed\nError Code : 5\nError Message : Operation failed with error = ERROR_ACCESS_DENIED (5)\n"
              ],
              "localized": "An error occurred while invoking external command : 'Using config file : /var/tmp/vmware/MACHINE_SSL_CERT.cfg\nError: 5, VMCAGetCertificatePrivate() failedStatus : Failed\nError Code : 5\nError Message : Operation failed with error = ERROR_ACCESS_DENIED (5)\n'"
          },
          "Error in generating cert for store MACHINE_SSL_CERT"
      ],
      "componentKey": null,
  
  

   

• From /var/log/vmware/vmcad/vmcad.log:

  info vmcad  t@139876657776384: Checking upn: cn=CAAdmins,cn=Builtin,dc=vsphere,dc=local against CA admin group: 
  
  info vmcad  t@139876657776384: Checking user's group: cn=DCAdmins,cn=Builtin,dc=vsphere,dc=local against CA admin group: cn=CAAdmins,cn=Builtin,dc=vsphere,dc=local
  2022-06-29T14:13:08.124992-05:00 info vmcad  t@139876657776384: Checking upn: cn=CAAdmins,cn=Builtin,dc=vsphere,dc=local against CA admin group: 
  warning vmcad t@139686066431744: error code: 0x00000005
  warning vmcad t@139686066431744: error code: 0x00000005
  warning vmcad t@139686066431744: error code: 0x0000000

Environment

VMware vCenter Server 7.x 

VMware vCenter Server 8.x

Cause

Missing permissions for groups DCAdmins and DCClients on group CAAdmins of vCenter SSO.

Resolution

Refer the below steps to update the missing members under CAAdmins.

Method 1: Identify and modify via command line.

• Take powered-off snapshot of the vCenter Server Appliance VM.
• SSH to the vCenter and login with root user. 
• Run command to check the members under CAAdmins

  • /usr/lib/vmware-vmafd/bin/dir-cli group list --name CAAdmins --login [e-mail]

• Run the command to add the missing member in the CAAdmins.

  • /usr/lib/vmware-vmafd/bin/dir-cli group modify --name CAAdmins --add DCAdmins --login [e-mail]

  • /usr/lib/vmware-vmafd/bin/dir-cli group modify --name CAAdmins --add DCClients --login [e-mail]
    

 

Method 2: Identify and modify using JXplorer

1. Take powered-off snapshot of the vCenter Server Appliance VM.
2. Log into the vCenter Server Appliance using JXplorer .
   • Refer to KB:Using JXplorer to connect to the vSphere Single Sign-on
3. Manually add new member under Bulltin-> CAAdmins
   • cn=DCAdmins,cn=Builtin,dc=vsphere,dc=local
   • cn=DCClients,cn=Builtin,dc=vsphere,dc=local

 

Additional Information