OVF export failed due to UNAUTHENTICATED/INTERNAL_SERVER

Products

VMware vCenter Server

Issue/Introduction

OVF export and Import is failing with the error:

Provider method implementation threw unexpected exception: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated) =&gt; {<br/>    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) =&gt; {<br/>    id = vapi.security.authentication.invalid,<br/>    defaultMessage = Unable to authenticate user,<br/>    args = [],<br/>    params = &lt;null&gt;,<br/>    localized = &lt;null&gt;<br/>}],<br/>    data = &lt;null&gt;,<br/>    errorType = UNAUTHENTICATED,<br/>    challenge = &lt;null&gt;<br/>}

/var/log/vmware/content-library/cls.log

YYYY-MM-DDT03:49:40.461Z | ERROR    | llbqd1b3-703-auto-jk-h5:70000396-fd-a1 | cls-simple-activity-20    | ExportSessionActivity          | Creation of transfer session failed
com.vmware.vapi.std.errors.InternalServerError: InternalServerError (com.vmware.vapi.std.errors.internal_server_error) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = vapi.bindings.method.impl.unexpected,
    defaultMessage = Provider method implementation threw unexpected exception: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = vapi.security.authentication.invalid,
    defaultMessage = Unable to authenticate user,
    args = [],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = UNAUTHENTICATED,
    challenge = <null>
},

Environment

VMware vCenter Server 7.x
VMware vCenter Server 8.x

Cause

This issue can occur if there are multiple STS Signing Certificate
cn=vsphere.local,cn=Tenants,cn=IdentityManager,cn=Services,dc=vsphere,dc=local

Following traces can be seen in /var/log/vmware/applmgmt/applmgmt.log

Traceback (most recent call last):
  File "/usr/lib/applmgmt/vapi/py/vmware/appliance/vapi/auth.py", line 243, in authenticate
    username = token.username
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 487, in username
    return self.get_name_id().value
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 940, in get_name_id
    '//saml2:Subject/saml2:NameID', self.reference)
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 478, in reference
    self.validate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 1170, in validate
    reference = super(HolderOfKeyToken, self).validate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 506, in validate
    signing_chain = self.validate_certificate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 686, in validate_certificate
    'One or more certificates cannot be verified.')
vmware.appliance.extensions.authentication.authentication_sso.AuthenticationError: One or more certificates cannot be verified.

Resolution

Replace STS Certificate and restart all services to resolve the issue.

Additional Information

Download fixsts script from the link below:
https://knowledge.broadcom.com/external/article?legacyId=76719