"error 20 at 0 depth lookup:unable to get local issuer certificate" when replacing Machine SSL or Solution user certificate with custom certificate

Products

• VMware
• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• When replacing Machine SSL or Solution user certificate with custom certificate, you see a message similar to -

error message:
<Certificate location>: C = XX, ST = XXXX, L = XXX, O = XX XX, OU = XXX, CN = machine_Name
error 20 at 0 depth lookup:unable to get local issuer certificate

• Error message can be also seen in certificate-manager.log file.
  
  In vCenter server appliance -
  
  /var/log/vmware/vmcad/certificate-manager.log
  
  In Windows vCenter server- 
  
  C:\ProgramData\VMware\vCenterServer\logs\vmca\certificate-manager.log

Environment

VMware Update Manager 6.0
VMware vCenter Server 6.0.x
VMware vCenter Server Appliance 6.0.x
VMware vSphere ESXi 6.0
VMware vCenter Converter Standalone 6.x

VMware vCenter Server 8.0.x

 

Cause

This error is triggered by OpenSSL used by certificate-manager tool.

This issue occurs due to the certificate chain provided while replacing certificate does not have complete chain.

Resolution

To resolve "error 20 at 0 depth lookup:unable to get local issuer certificate" when replacing Machine SSL or Solution user certificate with custom certificate follow the steps below -

1. Edit component, intermediate and root certificate files in notepad or vi editor.
2. Copy the content from intermediate certificate and root certificate.

Note: Certificate file will have component > Intermediate > root.

1. Open the component file, paste the content copied in the step #2 at the end of component certificate file and click Save.
2. Create a new file and add the content of the intermediate certificate and root certificate file and click Save. Intermediate > root.
3. When certificate-manager tool asks for certificate which you are trying to replace, use the component certificate saved in step #3, which is component > Intermediate > root chain.
4. When certificate-manager tool asks for Root Certificate, use the Root certificates saved in step #4, which is Intermediate > root chain.
5. Replace Machine SSL or Solution user certificate. For more information, see Replacing a vSphere 6.x Machine SSL certificate with a Custom Certificate Authority Signed Certificate (2112277)

Additional Information

Resolution: "error 2 at 1 depth lookup: unable to get issuer certificate." (50121853)