Auto Deploy rule management UI in vSphere Client is inaccessible with "Server has wrong SHA1 thumbprint"

Products

• VMware vCenter Server

Issue/Introduction

"The Auto Deploy > Deploy Rules functionality in the vCenter UI is inaccessible, displaying the error: 'Managing rules is temporarily unavailable. Server has wrong SHA1 thumbprint (required) != (server)'."

Environment

• VMware vCenter Server 6.x
• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

This can happen when the vCenter machine SSL certificate was recently replaced, but Auto Deploy ( vmware-rbd-watchdog) still uses the old certificate thumbprint.

Resolution

Before proceeding with these steps, ensure a current backup or snapshot of the vCenter Server is established. If the vCenter Server is part of an Enhanced Linked Mode (ELM) configuration, it is imperative to capture offline snapshots of all associated ELM nodes."

To solve the issue, apply the following steps:

1. Open an SSH connection to the VC and login with root
2. Run sqlite3 against the Auto Deploy database:

   # sqlite3 /var/lib/rbd/db

3. Run the following query to output the information about the VC from the DB, including current certificate thumbprint used by Auto Deploy:

   select * from vc_servers;

4. Exit sqlite3 by running:

   .quit

5. Now export the current machine SSL certificate from the vCenter Endpoint Certificate Store (VECS):

   # /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /tmp/machineSSL.crt

6. Next, use OpenSSL to output the SHA1 fingerprint of the exported certificate:

   # openssl x509 -in /tmp/machineSSL.crt -noout -fingerprint

7. Compare the fingerprint with the one seen in step 3. If they are different, move on with the next steps
8. Stop the Auto Deploy service:

   # service-control --stop vmware-rbd-watchdog

9. Connect sqlite3 with the Auto Deploy database:

   # sqlite3 /var/lib/rbd/db

10. Update the thumbprint in the database:

    update vc_servers set thumbprint = "<thumbprint from step 6>";

11. Exit sqlite3:

    .quit

12. Restart the Auto Deploy service:

    # service-control --start vmware-rbd-watchdog

Additional Information