Machine Certificate Fetching Error in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• In vSphere Client, when navigating to Administration -> Certificate Management, the following error appears:

Error occurred while fetching machine certificates

 

• In the /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log you will find entries similar to:

ERROR] http-nio-5090-exec-905    com.vmware.vise.mvc.exception.GlobalExceptionHandler       Exception handled while processing request for /ui/certificate-ui/ctrl/certificates/vmca-root?endPoint=vCENTER_FQDN: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated) => {
messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
  id = com.vmware.vapi.endpoint.method.authentication.required,
  defaultMessage = Authentication required.,
  args = [],
  params = <null>,
  localized = <null>
}],
  data = <null>,
  errorType = UNAUTHENTICATED,
  challenge = Basic realm="VAPI endpoint",SIGN realm=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,service="VAPI endpoint",sts="https://vCENTER_FQDN/sts/STSService/vsphere.local"

Environment

VMware vCenter Server 7.x

Cause

This issue is caused by a Signing Certificate Mismatch or an expired Security Token Service (STS) signing certificate in the VMware Directory Service (vmdir). When the STS certificate is invalid, the Lookup Service cannot issue valid tokens for the vSphere Client to retrieve certificate status.

Resolution

IMPORTANT: Always take an offline snapshot of the vCenter Server (and all participating vCenters in an Enhanced Linked Mode environment) prior to proceeding.

1. Download vCert script and upload to the vCenter

Note: If the connection to upload to the vCenter using WinSCP client is rejected you may need to change the shell as per Toggling the vCenter Server Appliance default shell

2. Execute the script as descripted in the Installation Section.

3. From the Menu select 3. Manage certificates >> 8 - STS signing certificates

4. Select "1. Replace STS Signing certificate with a VMCA-signed certificate"

5. Enter Y for Restart VMware Services

Additional Information

Note: After replacing STS Certificate successfully, it might take time to sync all the certificates. During this time, checking the certificate management in vSphere client will give the below error. Under such condition it is recommended to reboot the vCenter server.