vSphere Replication Configure option is not working and fails with error 'vSphere Replication - UI error: Unknown error' / vSphere Replication Plug-in Issue.
search cancel

vSphere Replication Configure option is not working and fails with error 'vSphere Replication - UI error: Unknown error' / vSphere Replication Plug-in Issue.

book

Article ID: 388708

calendar_today

Updated On:

Products

VMware Live Recovery

Issue/Introduction

Symptoms:

  • vSphere Replication is not manageable from the vSphere Client SRM plugin page and fails with the error 'vSphere Replication - UI error: Unknown error'.


  • Clicking on the "i" symbol shows the following information: "The vSphere Replication Management Server is not accessible. Check the Site Recovery integration plug-in logs for possible causes.":



  • The vSphere replication appliance will be accessible directly using the VAMI and DR pages.

    vSphere replication appliance VAMI login works fine: https://replication01:5480/   

    vSphere replication appliance DR login works fine:  https://replication01/dr

  • The hostname for the vSphere Replication appliance is configured with FQDN ( fully qualified domain name )

    Log in to the vSphere replication appliance via the putty application and type the hostname to check whether the vSphere replication appliance is configured with a short name or fqdn.

root [ /opt/vmware/logs/hms ]# hostname

<FQDN VR>

  • The vSphere Replication appliance VAMI page indicates that in the certificate CN=localhost or IP address or Shortname or anything other than actual hostname.

Environment

  • vSphere Replication 8.x

  • vSphere Replication 9.x

Cause

  • vSphere Replication appliance certificate is configured with a short name/IP address instead of FQDN which is configured in the networking hostname:

    In /opt/vmware/hms/logs/hms.log below events are seen :

    ####-##-## ##:##:##.### INFO  com.vmware.jvsl.util.SingleThumbprintVerifier [hms-vlsi-client-thread-738] (..jvsl.util.SingleThumbprintVerifier) [operationID=7527692d-d185-45ba-b691-############-HMSINT-214240] | Failed to validate certificate chain for ########.sample.com against HMS truststore. Error message: The certificate was not issued for use with the given hostname: <FQDN VR>

    In /opt/vmware/hmslogs/hms.log, below events are seen : 

    ####-##-## ##:##:##.### INFO  com.vmware.jvsl.util.SingleThumbprintVerifier [hms-ping-scheduled-thread-6] (..jvsl.util.SingleThumbprintVerifier) [operationID=ad3c98bc-bbf7-4484-a38c-############-HMS-PING] | Failed to validate certificate chain for ############## against HMS truststore. Error message: The certificate was not issued for use with the given hostname: <FQDN VR>

    The certificate chain validation will fail as the hostname for the vSphere Replication appliance does not match the CN (localhost/short name/IP address) in the certificate.

  • In  /opt/vmware/support/logs/dr-client-plugin/drplugin.log, below entries will be seen, suggesting mismatch between hostname and certificate.

    ####-##-## ##:##:##.### [srm-reactive-thread-13] WARN  com.vmware.dr.plugin.handlers.dashboard.VrHealthStatusHandler 2b2dd7e9-25ad-499c-9212-############  -
    DrRequestHandlerError:

    java.lang.Exception: Unable to get VR health status at URL: https://<FQDN VR>:5480/configureserver/health/hms?ui=1.
            at com.vmware.dr.plugin.handlers.dashboard.VrHealthStatusHandler$RequestCallback.fail(VrHealthStatusHandler.java:180)
            at com.vmware.dr.plugin.handlers.dashboard.VrHealthStatusHandler$RequestCallback.failed(VrHealthStatusHandler.java:158)
            at org.apache.http.concurrent.BasicFuture.failed(BasicFuture.java:137)
            at org.apache.http.impl.nio.client.DefaultClientExchangeHandlerImpl.executionFailed(DefaultClientExchangeHandlerImpl.java:101)
            at org.apache.http.impl.nio.client.AbstractClientExchangeHandler.failed(AbstractClientExchangeHandler.java:432)
            at org.apache.http.nio.protocol.HttpAsyncRequestExecutor.exception(HttpAsyncRequestExecutor.java:163)
            at org.apache.http.impl.nio.client.InternalIODispatch.onException(InternalIODispatch.java:82)
            at org.apache.http.impl.nio.client.InternalIODispatch.onException(InternalIODispatch.java:40)
            at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:125)
            at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)
            at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337)
            at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
            at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276)
            at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
            at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591)
            at java.base/java.lang.Thread.run(Unknown Source)
    Caused by: javax.net.ssl.SSLPeerUnverifiedException: Host name '<FQDN of VR>' does not match the certificate subject provided by the peer (C=US, ST=California, L=Palo Alto, OU=SRM, O="VMware, Inc.", CN=<Shortname>)
            at org.apache.http.nio.conn.ssl.SSLIOSessionStrategy.verifySession(SSLIOSessionStrategy.java:217)
            at org.apache.http.nio.conn.ssl.SSLIOSessionStrategy$1.verify(SSLIOSessionStrategy.java:197)
            at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:372)
            at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:547)
            at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120)
            ... 7 more

Resolution

Login to the vSphere Replication appliance VAMI page and update the certificate from short name to vSphere replication appliance FQDN 

  1. Log in to the vSphere Replication Appliance Management Interface as admin.

  2. Click on the Certificate option click on Change and validate whether the vSphere replication appliance hostname is correctly updated in FQDN format and complete the name change process flow and this will end the current vSphere replication appliance session. 



  3. Login back to the vSphere replication appliance and reconfigure the vSphere replication appliance using FQDN/Hostname. 


  4. Once the vSphere appliance reconfigures is completed, the vSphere Replication appliance should be manageable from the SRM UI page. 

 

Note: Do not Configure vSphere Replication using IP as its not recommended for reference, Change SRM or vSphere Replication registration from IP address to FQDN or visa versa

 

Powered by Wolken Software