When upgrading SDDC manager to version 5.2.1 the upgrade hands on Refresh Custom Certificates stage and after some time will failed.
VCF 5.x
In the lcm-debug.log you can see an entry like “Recoverable I/O Exception [java.net.SocketException] caught when processing request to https://storage.googleapis.com:443”:
Allow outgoing traffic in the firewall for https://storage.googleapis.com:443
Please see KB for public URL list for SDDC Manger: https://knowledge.broadcom.com/external/article/327186/public-url-list-for-sddc-manager.html