"The download source (...) is invalid or cannot be reached now" during the token update process for VCenter Lifecycle Manager Patch Setup

Products

VMware vCenter Server

Issue/Introduction

Updating the download URLs in vCenter Update Manager using a newly acquired download token fails.

When attempting a manual update, the following error message is displayed:

The download source https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml is invalid or cannot be reached now.

Using the the script from Authenticated Download Configuration Update Script results in these errors:

[INFO] vCenter "VCenter-FQDN" depot URL "https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/addon-main/vmw-depot-index.xml" is reachable from script execution machine < Name-fqdn > (it received a HTTP/200 message)
[ERROR] https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/addon-main/vmw-depot-index.xml is invalid.  Please make sure your token is correct and re-try.
[INFO] vCenter "VCenter-FQDN" depot URL "https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml" is reachable from script execution machine < Name-fqdn >  (it received a HTTP/200 message)
[ERROR] https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml is invalid.  Please make sure your token is correct and re-try.
[INFO] vCenter "VCenter-FQDN" depot URL "https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/iovp-main/vmw-depot-index.xml" is reachable from script execution machine < Name-fqdn >  (it received a HTTP/200 message)
[ERROR] https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/iovp-main/vmw-depot-index.xml is invalid.  Please make sure your token is correct and re-try.
[INFO] vCenter "VCenter-FQDN" depot URL "https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/vmtools-main/vmw-depot-index.xml" is reachable from script execution machine < Name-fqdn >   (it received a HTTP/200 message)
[ERROR] https://dl.broadcom.com/<Newly Generated Token ID>/PROD/COMP/ESX_HOST/vmtools-main/vmw-depot-index.xml is invalid.  Please make sure your token is correct and re-try

Environment

VMware vCenter Server 6.7.x.
VMware vCenter Server 7.0.x.
VMware vCenter Server 8.0.x.
VMware vCenter Server 9.x.x

Cause

This has been reported when the proxy settings are missing or incorrectly configured in the vCenter Appliance Management Interface (VAMI) page.
For example, the proxy might only be offering an HTTP interface to tunnel traffic to the outside, so only an HTTP proxy was configured.
However, because the download URLs in the Lifecycle Manager configuration will be set to HTTPS, VLCM is querying HTTPS_PROXY in /etc/sysconfig/proxy when trying to access the URLs. If the option is left empty, VLCM will assume that there is no proxy requirement for HTTPS URLs and instead tries to connect directly - which fails.
That means, even if the proxy server is only offering an HTTP interface to tunnel traffic to the outside, it is still necessary to configure that tunnel as HTTPS_PROXY.

Resolution

To resolve this issue, apply the following steps:

Open the vSphere Client UI and login with an account with administrator permissions (for example [email protected]).
On the Client home page, select Lifecycle Manager.
In the Lifecycle Manager interface, go to Settings.
Go to Administration → Patch Setup and review the Connectivity Status column. If any of the download sources are marked as Not Connected, proceed with the steps below.
Go to the vSphere Client inventory page and select the vCenter Server object.
Go to Configure → Settings → General $rarr; Internet Connectivity and confirm that the status is Enabled:
Validate Proxy Settings using the Appliance Management Interface (VAMI UI) as per Using the vCenter Server Management Interface to Configure vCenter Server:
- Connect to the VAMI UI on https://<vCenter-Hostname>:5480 and login with the [email protected] account.
- Once logged in, check the Networking section to validate the Proxy Settings.
- Ensure that the correct proxy server and port information is configured to allow vCenter to reach external resources.
If necessary, update the proxy information (If Needed), refer to Configure the DNS, IP Address, and Proxy Settings and to How to configure Proxy Settings for vCenter Server:
- If the proxy settings are incorrect or missing, update them with the correct values.
- Make sure that the HTTPS_PROXY option is properly configured - when using HTTPS URLs in Lifecycle Manager, VLCM will only use the proxy URL configured in this option.
  - Ensure that you are using HTTP for the proxy server connection, even if the proxy server supports HTTPS.
  - Edit the proxy configuration file: vi /etc/sysconfig/proxy
  - Set both HTTP_PROXY and HTTPS_PROXY to use HTTP, e.g.:
    HTTP_PROXY="http://<your-proxy:port>/"
    HTTPS_PROXY="http://<your-proxy:port>/"
- If required, reach out to the internal network/firewall team to get the necessary proxy server settings.
- Refer Troubleshoot problems with vSphere Lifecycle Manager proxy configuration for more details.
Test Connectivity:
- After updating the proxy, try to test connectivity again to ensure that vCenter can connect to external resources, such as the depot for patch updates.
Reattempt Token Update:
- With the correct proxy information in place, try to update the token again manually or using the scripted method (using PowerCLI) as per VCF authenticated downloads configuration update instructions.