An error stating 'not a valid CA Certificate' occurs when replacing the custom Machine SSL certificate

Products

• VMware vCenter Server

Issue/Introduction

Any attempts to publish a custom Machine SSL certificate in vCenter release 8.0u1 or later fails

CLI - Immediately fails 0% failing to publish root certificate

vSphere UI - Internal Server Error




/var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log

YYYY-MM-DDTHH:mm-ss [tomcat-exec-6 [] WARN  com.vmware.vapi.internal.bindings.ApiMethodSkeleton  opId=] Implementation method reported unexpected exception: com.vmware.vapi.std.errors.Error
com.vmware.vapi.std.errors.Error: Error (com.vmware.vapi.std.errors.error) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = com.vmware.certificatemanagement.error,
    defaultMessage = Internal Server Error (Certificate bearing subject <CERTIFICATE_SUBJECT_INFO> is not a valid CA certificate. Please retry with a valid certificate chain),
    args = [Certificate bearing subject <CERTIFICATE_SUBJECT_INFO>
 is not a valid CA certificate. Please retry with a valid certificate chain],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = ERROR

Environment

VMware vCenter Server 8.x 

Cause

Beginning in vCenter 8.0u1 a validation check is observed in new deployments or attempting to replace custom certificates for a 'Certificate Key Usage' attribute.


If this Certificate KeyUsage attribute is not present the certificate will not be accepted as a valid CA & certificate replacement will fail


Present Certificate Key Usage attribute:



 Missing Certificate Key Usage attribute:

Resolution

 

1. Verify the attributes of your Root CA certificate using OpenSSL:
   bash

    

   openssl x509 -in cacert.pem -noout -text | grep -A 1 "Key Usage"

2. Confirm if Certificate Sign is listed under X509v3 Key Usage.
3. If the attribute is missing, engage your internal CA administrator to regenerate the Root CA certificate ensuring the Key Usage extension includes keyCertSign.
4. Once the compliant Root CA is obtained, retry the certificate replacement using vCert.py or the vSphere Client UI.

Additional Information

Certificates must meet the minimum requirements as outlined in Replace Machine SSL Certificate with Custom Certificate and Generate Certificate Signing Request for Machine SSL Certificate Using the vSphere Client (Custom Certificates).