Connecting an ESXi host to vCenter Server fails with a Timeout error

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• You are unable to join an ESXi host to vCenter Server.
• In the /var/log/vpxa.log file you see errors similar to:
  
  -> backtrace[01] rip 1d642698 Vmacore::System::SystemFactoryImpl::CreateQuickBacktrace(Vmacore::Ref<Vmacore::System::Backtrace>&)
  --> backtrace[02] rip 1d5e10c5 Vmacore::Throwable::Throwable(std::string const&)
  --> backtrace[03] rip 1dc7f2d6 Vmomi::SoapStubAdapterImpl::InvokeCommon(Vmomi::MoRef*, Vmomi::ManagedMethod*, Vmacore::RefVector<Vmomi::Any> const&, Vmomi::RequestContext*, bool, Vmacore::Ref<Vmomi::Any>&)
  -<YYYY-MM-DD>T<time>Z [5FA21B90 verbose 'hostdcnx' opID=C3D17DC4-00001F27-fa-f8] [VpxaHalCnxHostagent] Authenticate succeeded: userName=vpxuser</time>
  <YYYY-MM-DD>T<time></time>Z [5FA21B90 error 'vpxavpxaVmomi' opID=C3D17DC4-00001F27-fa-f8] [VpxaClientAdapter::InvokeCommon] Got exception while invoking retrieveContent on vim.ServiceInstance:ServiceInstance: 'Invalid state', backtrace:
  --> backtrace[00] rip 1d81c333 Vmacore::System::Stacktrace::CaptureWork(unsigned int)
  --> backtrace[04] rip 1dc7f728 Vmomi::SoapStubAdapterImpl::Invoke_Task(Vmomi::MoRef*, Vmomi::ManagedMethod*, Vmacore::RefVector<Vmomi::Any>&, Vmomi::RequestContext*, Vmacore::Ref<Vmomi::Any>&)
  --> backtrace[05] rip 0a6d6134 /usr/lib/vmware/vpxa/bin/vpxa [0xa6d6134]
  --> backtrace[06] rip 0a6d64c8 /usr/lib/vmware/vpxa/bin/vpxa [0xa6d64c8]
  <YYYY-MM-DD>T<time></time>Z [5FA21B90 error 'hostdcnx' opID=C3D17DC4-00001F27-fa-f8] [VpxaHalCnxHostagent] Failed while trying to connect to hostd on the sdk port: vmodl.fault.HostCommunication
  <YYYY-MM-DD>T<time></time>Z [5FA21B90 info 'commonvpxLro' opID=C3D17DC4-00001F27-fa-f8] [VpxLRO] -- FINISH task-internal-9 -- -- vpxapi.VpxaService.login --
  <YYYY-MM-DD>T<time></time>Z [5FA21B90 info 'Default' opID=C3D17DC4-00001F27-fa-f8] [VpxLRO] -- ERROR task-internal-9 -- -- vpxapi.VpxaService.login: vmodl.fault.HostCommunication:
  --> Result:
  --> (vmodl.fault.HostCommunication) {
  --> dynamicType = <unset>,
  --> faultCause = (vmodl.MethodFault) null,
  --> msg = "",
  --> }
  --> Args:
   
• In the vpxd.log file of vCenter Server you see errors similar to:
  
  <YYYY-MM-DD>T<time></time>Z [7FE1CFAED700 error 'HttpConnectionPool-000001'] [ConnectComplete] Connect failed to <cs p:00007fe1c0234b80, TCP:esxi02.domain.tld:443>; cnx: (null), error: N7Vmacore3Ssl18SSLVerifyExceptionE(SSL Exception:
  Verification parameters:
  --> PeerThumbprint: FA:2A:6A:AB:B4:44:EA:45:31:0F:8B:98:9B:F5:C9:E0:4C:B6:97:64
  --> ExpectedThumbprint:
  --> ExpectedPeerName: esxi02.domain.tld
  --> The remote host certificate has these problems:
  -->
  --> * Host name does not match the subject name(s) in certificate.
  -->
  --> * unable to get local issuer certificate)
  <YYYY-MM-DD>T<time></time>Z [7FE1CEF56700 error 'vpxdvpxdInvtHost' opID=C3D17DC4-00001F99-84] [VpxdInvtHost::HandlePreRemovalCleanup] Failed to reconnect to cleanup before host removal : N3Vim5Fault14SSLVerifyFault9ExceptionE(vim.fault.SSLV
  erifyFault)
  <YYYY-MM-DD>T<time></time>Z [7FE1CEF56700 warning 'vpxdvpxdMoLicenseManager' opID=C3D17DC4-00001F99-84] [LicMgr] Trying to remove licenses. Host was never registered with the license manager.
  <YYYY-MM-DD>T<time></time>Z [7FE1CEF56700 error 'linuxvpxLdap_linux' opID=C3D17DC4-00001F99-84] [LDAP Client] [LDAP Client] Failed to delete LDAP entrycn=host-2186:DABC2789-DD44-4E18-A280-ABFDDA1D1A94,ou=LicenseEntities,ou=Licensing,dc=virt
  ualcenter,dc=vmware,dc=int: 0x32 (No such object)
  <YYYY-MM-DD>T<time></time>Z [7FE1CEF56700 error 'licenseldapStorage' opID=C3D17DC4-00001F99-84] [LicMgr] Failed to remove assignment
  <YYYY-MM-DD>T<time></time>Z [7FE1CEF56700 error 'Default' opID=C3D17DC4-00001F99-84] (Log recursion level 2) vmodl.fault.SystemError
  
  Note: For more information, see Location of vCenter Server log files

Environment

VMware vSphere ESXi 6.x

VMware vSphere ESXi 7.x

VMware vSphere ESXi 8.x

 

Cause

This issue can occur if the host certificate has one of these problems:

• The host name does not match the Subject Name(s) in certificate.
• vCenter Server is unable to recognize the local issuer certificate.

Resolution

To resolve this issue, regenerate the ESXi host certificates.

 

To regenerate new self-signed certificates for ESXi, see the Generating New Self-Signed Certificates for ESXi section in the vSphere Security guide.

 

Additional Information

'PSC_FQDN' doesn't match with hostname in Platform Services Controller certificate