Unable to register vCenter SSO with HCX

VMware HCX VMware vCenter Server

On the HCX admin page 9443, under Configuration -> SSO, the SSO registration failed with the following error:
"Lookup service is not reachable at https://<FQDN-or-ip>. Please enter a valid SSO url - https://<domain|ip>"

The following error is logged in the HCX Manager at /common/logs/appliance-management/appliance-management.log : "Cannot load STS signer certificate."

2024-03-27 07:49:51.148 UTC [https-jsse-nio-9443-exec-7, , ] ERROR c.v.h.a.c.LookupServiceConfigValidator- Cannot load STS signer certificate from https://<FQDN-or-ip>:7444/sso-adminserver/sdk/vsphere.local
2024-03-27 07:49:51.149 UTC [https-jsse-nio-9443-exec-7, , ] WARN c.v.h.a.c.LookupServiceConfigValidator- Cannot access lookup service at https://<FQDN-or-ip>:443/lookupservice/sdk
java.lang.Exception: Cannot load STS signer certificate from https://<FQDN-or-ip>:7444/sso-adminserver/sdk/vsphere.local

HCX
vCenter 6.5 or later

This issue is related to vCenter (STS).
It typically occurs due to an SSL trust mismatch on the vCenter side.

Please use the lsdoctor script, available at Using 'lsdoctor' Tool

Ensure you take backups and snapshots of vCenter before running the lsdoctor tool.
For more information on vCenter snapshots, visit VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

python lsdoctor.py -l >> to check for SSL trust mismatch and stale configurations in vCenter upgraded from 5.x.
python lsdoctor.py -t >> to fix SSL trust issues

Note: If you find stale legacy endpoints after running command python lsdoctor.py -l , then you need to run python lsdoctor.py -s to clean up any stale configurations left over from a vCenter system upgraded from 5.x

Register the SSO again with HCX.

Please contact the vCenter Support Team for any queries or issues on the lsdoctor tool.