Smart Card Login fails to vCenter when processing a large CRL

Products

• VMware vCenter Server

Issue/Introduction

• After Smart Card certificate selection and PIN prompt, login fails with  "username and password required".
  
  
• Smart Card authentication is successful when Deactivating Smart Card certificate revocation.

Environment

vCenter 8
vCenter 7

Cause

vCenter can run out of memory processing a large Certificate Revocation List (CRL) to check the revocation status of a Smart Card certificate.

Resolution

Increase the memory for vmware-stsd following Manually increasing the heap memory of components in vCenter Server 6.x, 7.x and 8.x

i.e., 

1. Run the following command to output memory assigned to each of the services:

vcsa# cloudvm-ram-size -l

2. Increase the amount of memory assigned to the vmware-stsd service by running the following command,

vcsa# cloudvm-ram-size -C XXXX vmware-stsd

Note: XXXX should be replaced with the desired amount of memory in MB.

3. Restart the vmware-stsd service,

vcsa# # /usr/lib/vmware-vmon/vmon-cli --restart sts

Workaround by Deactivating Revocation Checking or if Non-FIPS use OCSP for Revocation Checking instead of CRL.