Error "Failed to connect to the server: certificate_unknown(46)" during the initial Usage Meter connection or when attempting to send data to VCF Business Services console portal on existing deployment
search cancel

Error "Failed to connect to the server: certificate_unknown(46)" during the initial Usage Meter connection or when attempting to send data to VCF Business Services console portal on existing deployment

book

Article ID: 321898

calendar_today

Updated On: 06-09-2025

Products

VMware Aria Suite

Issue/Introduction

  • Unable to complete the initial Usage Meter configuration

    Error: Failed to connect to the proxy server: certificate_unknown


  • Testing Cloud connectivity for existing Usage Meter fails with following error:

    The Cloud Connectivity page listed this error: "VCF Business Services console Test Failed due to "Upload failure for Notification stream. Authentication flow returned an error""
    "Failed to connect to the server: certificate_unknown(46)"
  • In /opt/vmware/cloudusagemetering/var/logs/dss_main.log you see errors similar to the following: 
202#-##-## 14:04:38.085 ERROR --- [dss_hub_test_proxy_update] com.vmware.um.uploader.ProxyTester: Proxy test failed with IOException: certificate_unknown(46)
org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
    at org.bouncycastle.jsse.provider.ProvSSLSocketWrap.checkServerTrusted(ProvSSLSocketWrap.java:131)
    at org.bouncycastle.jsse.provider.ProvTlsClient$1.notifyServerCertificate(ProvTlsClient.java:360)
Caused by: java.security.cert.CertificateException: Unable to construct a valid chain
    at org.bouncycastle.jsse.provider.ProvX509TrustManager.validateChain(ProvX509TrustManager.java:313)
    at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkTrusted(ProvX509TrustManager.java:272)
    at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkServerTrusted(ProvX509TrustManager.java:181)
    at org.bouncycastle.jsse.provider.ProvSSLSocketWrap.checkServerTrusted(ProvSSLSocketWrap.java:127)
    ... 43 common frames omitted
Caused by: java.security.cert.CertPathBuilderException: No issuer certificate for certificate in certification path found.
    at org.bouncycastle.jcajce.provider.PKIXCertPathBuilderSpi.engineBuild(Unknown Source)

Environment

VMware Usage Meter 4.x
VCF Usage Meter 9.x

 

Cause

Usage Meter cannot connect to the cloud portal because the proxy/firewall certificate is not imported or SSL connections are blocked by underlying network/firewall device

Resolution

  1. To confirm the connection between the usage meter and the cloud portal, and to verify the certificate used for this connection, please execute the following command:

    curl -kv  https://eapi.broadcom.com/vcf/ums/api/v2/data/9.0

  2. Import the firewall, load balancer, or proxy certificate based on your environment by following the "Import a Certificate to the vCloud Usage Meter Appliance Keystore" section.
  3. Remove Usage Meter from SSL inspection from underlying network device/application

 

 

 

Additional Information