Adding vCenter to Usage Meter fails with a certificate error

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:
When a vCenter server is added to Usage Meter, the following error is received:

Certificate error for <FQDN>: Signature for certificate 0 can not be verified

Environment

VMware vCloud Usage Meter 4.8

Cause

Check if the cause for the unsuccessful attempt to add vCenter to Usage Meter is due to any of the following scenarios:

• vCenter certificate chain is incorrect 
• vCenter certificate is not completely available 

openssl s_client -showcerts -connect <FQDN>:443

If the cause is any of the scenarios above, then the output of this command will be incomplete/incorrect details.

Resolution

1.    Ensure that the vCenter certificate is correctly populated in both the Machine SSL Certificate section in the order: Server, Intermediate, Root at the end and the Chain of Trusted Root Certificates section in the order: Intermediate, Root at the end).

2.    In the vCenter under the Administration >> Certificates >> Certificate Management, click on Machine SSL tab to get the page to confirm the certificates are properly populated.

3.    Provide the complete certificate chain in the Machine SSL Certificate section, ensuring the order is Server, Intermediate, Root.

4.    Subsequently, provide the Root chain again in the Chain of Trusted Root Certificates section, maintaining the order Intermediate and Root at the end,

5.    Failure to follow the above steps may result in the import succeeding, but vCenter will only send the Server and Root certificate details when accessed. Consequently, the Usage Meter VM will not have access to the complete certificate chain.

 

Additional Information

Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate