vSphere Update Manager Download Service (UMDS) fails to download updates when SSL inspection is being used
search cancel

vSphere Update Manager Download Service (UMDS) fails to download updates when SSL inspection is being used

book

Article ID: 369406

calendar_today

Updated On:

Products

VMware vCenter Server 8.0 VMware vCenter Server 7.0 VMware vCenter Server

Issue/Introduction

When trying to download patches using the VMware vSphere Update Manager Download Service tool (UMDS), the download fails.

  • The system where UMDS is installed is running in a secure environment where SSL inspection is being used, e.g. by an SSL inspection proxy.
    This is a system that intercepts incoming SSL traffic, decrypts it for inspection purposes, and the re-encrypts the traffic with its own certificate before sending it on the the intended receiver.
  • When running try to enforce the patch download using:
    # vmware-umds -D
    the following error stack can be seen in the output:
    [<timestamp>] verbose vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 181] * CONNECT tunnel established, response 200
    [<timestamp>] verbose vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 181] * ALPN: curl offers http/1.1
    [<timestamp>] verbose vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 181] * CAfile: /etc/pki/tls/certs/ca-bundle.crt
    [<timestamp>] verbose vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 181] * CApath: /etc/ssl/certs
    [<timestamp>] verbose vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 181] * SSL certificate problem: unable to get local issuer certificate
    [<timestamp>] verbose vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 181] * Closing connection
    [<timestamp>] error vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 685] curl_easy_perform() failed: CURL Error: SSL peer certificate or SSH remote key was not OK, SSL certificate problem: unable to get local issuer certificate
    [<timestamp>] error vmware-downloadService[09266] [Originator@6876 sub=httpDownload] [httpDownloadPosix 685] [backtrace begin] product: VMware vSphere Update Manager Download Service, version: 8.0.2, build: build-23319993, tag: vmware-downloadService, cpu: x86_64, os: linux, buildType: release
    -- > backtrace[00] libvmacore.so[0x0053D3AB]
    -- > backtrace[01] libvmacore.so[0x0043197E]: Vmacore :: System :: Stacktrace :: CaptureFullWork(unsigned int)
    -- > backtrace[02] libvmacore.so[0x00444252]: Vmacore :: System :: SystemFactory :: CreateBacktrace(Vmacore :: Ref<Vmacore :: System :: Backtrace>&)
    -- > backtrace[03] libvci-vcIntegrity.so[0x00DA8C73]
    -- > backtrace[04] libvci-vcIntegrity.so[0x00DA9074]
    -- > backtrace[05] libvci-vcIntegrity.so[0x00DA98B0]: Sysimage :: HttpDownloadFile(std ::_ cxx11 :: basic_string<char, std :: char_traits<char>, std :: allocator<char> > const&, std :: cxx11 :: basic_string<char, std :: char_traits<char>, std :: allocator<char> > const&, Integrity :: ProxyServer const&, std ::_ cxx11 :: basic_string<wchar_t, std :: char_traits<wchar_t>, std :: allocator<wchar_t> > const&, int, int, int, std ::_ cxx11 :: basic_string<char, std :: char_traits<char>, std :: allocator<char> > const&, bool const&)
    -- > backtrace[06] libvci-vcIntegrity.so[0x00DA4CBA]: Sysimage :: DownloadJobHandler :: Download()
    -- > backtrace[07] libvmacore.so[0x0037DBE6]
    -- > backtrace[08] libvmacore.so[0x003834F9]
    -- > backtrace[09] libvmacore.so[0x0051D093]
    -- > backtrace[10] libc.so.6[0x00089C02]
    -- > backtrace[11] libc.so.6[0x0010EC40]
    -- > backtrace[12] (no module)
    -- > [backtrace end]
    [<timestamp>] error vmware-downloadService[09266] [Originator@6876 sub=DownloadMgr] [downloadMgr 701] Executing download job {140278933502000} throws error: curl_easy_perform() failed: CURL Error: SSL peer certificate or SSH remote key was not OK, SSL certificate problem: unable to get local issuer certificate

Environment

  • VMware vSphere Update Manager Download Service (UMDS) 7.x
  • VMware vSphere Update Manager Download Service (UMDS) 8.x

Cause

In order to establish a connection with the official download repository, UMDS must be able to authenticate the validity of the certificate the incoming traffic was encrypted with.This is usually done by verifying that the trusted certificate chain for the certificate authority, who signed the certificate is in the trusted root certificate store of the operating system UMDS is installed on.

Resolution

  1. Verify that the system is affected by the issue, by using curl to connecting to the download source and compare the certificate information in the output with the ones in the example below, specifically for the issuer:
    # curl -kv -x <proxy-URL> https://dl.broadcom.com/<dowload-token>/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml
    ..
    * ALPN: server accepted http/1.1
    * Server certificate:
    *   subject: CN=dl.broadcom.com
    *   start date: Aug 31 21:47:15 2026 GMT
    *   expire date: Nov 29 22:47:11 2026 GMT
    *   issuer: C=US; O=Google Trust Services; CN=WE1
    *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
    *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
    *   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
    * OpenSSL verify result: 14
    *  SSL certificate verification failed, continuing anyway!
    ..
    Notes:
    • Most SSL inspection applications act as proxies - but curl does not automatically apply the proxy settings configured in the operating system, hence the proxy needs to be manually added in the command using -x the option as seen above.
    • The example above is valid at the time this article was written.
  2. If the certificate receive with the above command matches the example, confirm if the download token is entitled for downloading patches. Refer to Authenticated downloads configuration update instructions - VCF for more information.
    If the certificate received in step 1 does not match the example, e.g. if the Subject or the Issuer are different, continue with the next steps.
  3. Collect the trusted certificate chain presented by the SSL inspection system (proxy), consisting of:
    • The certificate for the CA which is named as the issuer in the curl output,
    • Any other intermediate CA which has signed the certificate above
    • The root CA certificate
  4. Import the chain into the trusted root certificate store of the operating system UMDS is installed on. These way to do this will vary depending on the type/distribution of operating system. Refer to the OS manual or reach out to the OS vendor in case assistance with this is required.
Powered by Wolken Software