Unable to download Trusted Roots Certificates for VCSA because it shows 0kb file.

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Assist TSE's and Customers fix this issue which in some cases is critical depending on the environment.

Symptoms:

• unable to download Trusted Roots Certificates for VCSA because it shows 0kb file.
• HTTP error 404 not found
  
  
• When downloading them Via CLI with wget  you get  an error 404: Not found 
  
  wget https://<VC URL>/certs/download.zip
--2022-08-22 15:08:31--  https://<VC URL>/certs/download.zip
Resolving <VC URL>... 127.0.0.1
Connecting to<VC URL>|127.0.0.1|:443... connected.
HTTP request sent, awaiting response... 404 Not Found
2022-08-22 15:08:31 ERROR 404: Not Found.

Environment

• VMware vCenter Server 6.7.x
• VMware vCenter Server 7.0.x
• VMware vSphere ESXi 6.7.x
• VMware vSphere ESXi 7.0.x

Cause

Missing simlink for /etc/vmware-vpx/docRoot/certs

Resolution

1. Take proper Snapshots for your SSO topology.(If enhanced Linked Mode it needs to be powered off snapshots).
2. Make sure CRL's are not causing the issue vmware-vapi-endpoint fails to start or crashes after upgrading to vCenter Server 6.5 Update 2
3. check if symlink for /var/lib/vmware-vpx/docRoot/certs to /etc/vmware-vpx/docRoot/certs  exists.

4.  ls -ltra /etc/vmware-vpx/docRoot if the certs symlink does not exist  run this command to create it: ln -sfn /var/lib/vmware-vpx/docRoot/certs /etc/vmware-vpx/docRoot/certs

Note: for 6.x please use the command  ln -sfn /etc/vmware-vpx/ssl /etc/vmware-vpx/docRoot/certs

5. Restart VCSA  services using command service-control --stop --all && service-control --start --all or reboot VCSA.
6. Try downloading the Trusted Root Certificates again.

Additional Information

Impact/Risks:
Medium. Depending on the environment.
If deploying VXRail or any other 3rd party solutions that require trusted root certificates to be imported.