Symptoms:
- Upgrading or Patching vCenter Server to 8.0 U2a or above versions shows following pre-check error message:
VMCA root certificate validation failed.
VMCA root certificate does not have 'Subject Key Identifier' extension.
Suggested Resolution: VMCA root certificate on vCenter needs to be regenerated. Refer to VMware KB 94840 for more details.
- Patching to 8.0 U2 fails with any of below failures :
Failure while generating 'wcp' certificate
/var/log/vmware/applmgmt/PatchRunner.log will show similar to below snippets :
2023-09-27T01:37:47.391Z wcp:Patch ERROR root Failed to update solution user wcp.
Traceback (most recent call last):
File "/usr/lib/vmware-wcp/py-modules/wcpconfigure.py", line 352, in update
self._gen_cert()
File "/usr/lib/vmware-wcp/py-modules/wcpconfigure.py", line 192, in _gen_cert
invoke_command(
File "/usr/lib/vmware/site-packages/cis/utils.py", line 372, in invoke_command
raise InvokeCommandException(errStr='Command: %s\nStderr: %s' %\
cis.exceptions.InvokeCommandException: {
"detail": [
{
"id": "install.ciscommon.command.errinvoke",
"translatable": "An error occurred while invoking external command : '%(0)s'",
"args": [
"Command: ['/usr/lib/vmware-vmca/bin/certool', '--server=vc1.example.com', '--genCIScert', '--dataencipherment', '--privkey=/tmp/wcp_r2t4vosr.priv', '--cert=/tmp/wcp_fotsa0sr.crt', '--Name=wcp']\nStderr: "
],
"localized": "An error occurred while invoking external command : 'Command: ['/usr/lib/vmware-vmca/bin/certool', '--server=vc1.example.com', '--genCIScert', '--dataencipherment', '--privkey=/tmp/wcp_r2t4vosr.priv', '--cert=/tmp/wcp_fotsa0sr.crt', '--Name=wcp']\nStderr: '"
}
2023-09-27T01:37:47.392Z wcp:Patch ERROR wcp Failed to apply patch %s! Error: %s.
2023-09-27T01:37:47.392Z wcp:Patch ERROR wcp Not all patches were applied. Latest applied patch is 1
2023-09-27T01:37:47.392Z wcp:Patch ERROR vmware_b2b.patching.executor.hook_executor Patch hook 'wcp:Patch' failed.
/var/log/vmware/applmgmt/update_microservice.log will show similar to below snippets :
2023-09-27T01:37:47.390Z Done running command\n"
error=b"2023-09-27T01:37:47.390Z Invoked command: ['/usr/lib/vmware-vmca/bin/certool', '--server=vc1.example.com', '--genCIScert', '--dataencipherment', '--privkey=/tmp/wcp_r2t4vosr.priv', '--cert=/tmp/wcp_fotsa0sr.crt', '--Nam
e=wcp']\n2023-09-27T01:37:47.390Z RC = 124\nStdout = Error: 70012, VMCAGetSignedCertificatePrivate() failedStatus : Failed\nError Code : 70012\nError Message : Invalid CSR field\n\nStderr = \n"
- vCenter Server major upgrade from 6.x or 7.x to 8.0 U2 fails with any of below errors
"
Failed to create data encipherment cert with hostname/ip"/var/log/firstboot/vpxd_firstboot.py_xxxx_stderr.log
2023-09-27T13:59:02.247Z Invoked command: ['/usr/lib/vmware-vmca/bin/certool', '--server=vc2.example.com', '--genCIScert', '--dataencipherment', '--privkey=/etc/vmware-vpx/ssl/tmp-data-encipherment.key', '--cert=/etc/vmware-vpx/ssl/tmp-data-encipherment.crt', '--Name=data-encipherment', '--FQDN=vc2.example.com']
2023-09-27T13:59:02.247Z RC = 124
Stdout = Error: 70012, VMCAGetSignedCertificatePrivate() failedStatus : Failed
Error Code : 70012
Error Message : Invalid CSR field
Stderr =
2023-09-27T13:59:02.247Z VirtualCenter firstboot failed
- Any Certificate replacement on vCenter Server after upgrading to 8.0 U2 fails with below error message :
Error: 70012, VMCAGetSignedCertificatePrivate() failedStatus : Failed
Error Code : 70012
Error Message : Invalid CSR field