VMware is aware of this issue and working towards a fix in a future release.
Workaround:
There are several ways to workaround this issue:
Option 1Permit Secure TLS Renegotiation at the Load Balancer (Recommended)
Load balancers such as Citrix NetScalers use SSL Profiles to configure SSL protocol handling on a per-server, per-service, or per-port basis and support separate internal and external configuration. To workaround this issue, locate the SSL Profile used by vCenter, then change the denySSLReneg setting to NONSECURE. This will permit secure negotiation, resolving the issue. For more information, see the following Citrix documents:
For other Load Balancer solutions, please consult the documentation provided by the given vendor about configuring SSL renegotiation.
Option 2Set up the LDAPS connection URL to bypass the load balancer.
You may also work around this issue by setting the connection URL in the identity source to specify a domain controller rather than using the load balancer. Please note that this will only work if the network traffic from the vCenter to the Domain Controller is not still being routed through the load balancer.
- In the vSphere Client, navigate to Administration.
- Select Configuration under Single Sign On.
- Within the Identity Sources section, select the AD over LDAP identity source and click Edit.
- Update the Primary server URL to connect directly to a domain controller instead of the load balancer.
- Click Save.
Note: If bypassing the load balancer requires a different certificate to be used, the identity source will need to be recreated using the correct one from the domain controller specified in the connection URL.