HCX- Plug-in download error after vCenter restore

Products

• VMware HCX

Issue/Introduction

This document is created as a reference for the HCX vSphere Web Client plug-in recovery post restoration of vCenter from backup.

Symptoms:
When a vCenter is restored from backup it may fail to download the HCX vSphere Web Client plug-in.

vCenter Task alert:



vsphere_client_virgo.log reports:

[2021-08-17T05:56:13.035Z] [ERROR] -async-task-executor-pool-89  com.vmware.vise.extensionfw.plugins.impl.PluginStatusServiceImpl  DOWNLOAD_FAILED: Error downloading plugin package com.vmware.hybridity:4.2.0.18418399 from https://<hcx-ip>:443/files/ngcplugin/hybridity-ngc-plugin.zip. Reason: Download error. Make sure that the URL is reachable and the thumbprint is correct. com.vmware.vise.plugin.download.PluginDownloadException: javax.net.ssl.SSLHandshakeException: Server certificate chain is not trusted and thumbprint doesn't match

Location of vsphere_client_virgo.log:

• vCenter Server Appliance : /var/log/vmware/vsphere-ui/logs/

Cause

This can occur in below two scenarios:

1. HCX is unreachable from within the vCenter (on port 443).

SSH to vCenter:
Run: nc -vz <HCX-IP> 443
 

root@vcenter [ ~ ]# nc -vz <HCX-IP> 443
<HCX-URL> [HCX-IP] 443 (https) open

2. Verfiy if thumbprint seen in Extension Manager of vCenter is same as current thumbprint of HCX. 

a. Navigate to: https://<<VC-IP>>/mob/?moid=ExtensionManager&doPath=extensionList%5b%22com%2evmware%2ehybridity%22%5d%2eserver
Make a note of "serverThumbprint" value.
 

b. Grab SHA-1 thumbprint of HCX by hitting URL https://<<HCX-IP>>
Make sure the value of thumbprint of HCX should be same as the one obtained from MOB console.

Go to Site Information tab on the URL:

---> Connection secure


---> More Information


---> Security


---> View Certificate


This shows a mismatch in the value of thumbprint of HCX with the one obtained from MOB console, which results in error downloading plug-in situation with vSphere Web Client.

Resolution

Ensure network connectivity can be established from the impacted vCenter server to the plug-in download URL over 443. Also, thumbprint seen in Extension Manager of vCenter should be same as current thumbprint of HCX.

Workaround:

To fix thumbprint mismatch between vCenter and HCX,

SSH to HCX Mgr:
Run: /etc/rc.d/init.d/RegisterExtension

Logout and login to vCenter web client to force plugin download.
If this doesn't help then consider restarting web client process.

Additional Information

Impact/Risks:
Due to absence of HCX vSphere Web Client plugin, HCX hybridity UI will not be accessible from vCenter. However, it will not impact HCX hybridity Standalone(443) UI.