Unable to add a standalone ESXi host to vCenter

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• When trying to add an ESXi host to vCenter the operation fails with an error "A general system error occurred: Unable to push signed certificate to host <hostname>"
• In /var/log/vmware/vpxd/vpxd.log: error similar to below are observed

  

  YYYY-MM-DDTHH:MM:SS.MSSZ info vpxd[07769] [Originator@6876 sub=vmomi.soapStub[183] opID=#opID-UUID#] SOAP request returned HTTP failure; <<io_obj p:0x00007f9a642ad288, h:64, <UNIX ''>, <UNIX '/var/run/envoy-hgw/hgw-pipe'>>, hgw/<host-moid>/sdk>, method: installServerCertificate; code: 500(Internal Server Error); fault: (vim.fault.HostConfigFault) {
  -->    faultCause = (vmodl.MethodFault) null,
  -->    faultMessage = (vmodl.LocalizableMessage) [
  -->       (vmodl.LocalizableMessage) {
  -->          key = "vim.hostd.vimsvc.certificateManager.checkTime",
  -->          arg = <unset>,
  -->          message = "Time validation failed. Check host Time and/or Certificate expiration data (notBefore, notAfter)."
  -->       }
  -->    ]
  -->    msg = "Received SOAP response fault from [<<io_obj p:0x00007f9a642ad288, h:64, <UNIX ''>, <UNIX '/var/run/envoy-hgw/hgw-pipe'>>, /hgw/<host-moid>/sdk>: installServerCertificate
  --> Cannot change the host configuration."
  --> }

Environment

• VMware vSphere ESXi
• VMware vCenter Server

Cause

• This can be caused by a time mismatch between the standalone host and the vCenter. The time drift between ESXi host and vCenter Server blocks the connection needed added the ESXi host to the vCenter Server's inventory.

Resolution

Verify the time on both host and vCenter by running the date command below on both ESXi and vCenter's SSH

1. Login as "root" user on both vCenter and ESXi Host and run the command below: 

   date

   Date command output example:
   
2. If the values do not match between host and vCenter, then manually set the time on the ESXi host to match the vCenter Server with the steps bellow:
3. Log into the ESXi Host Client. The default URL is https://host_IP_or_FQDN/ui
4. Click the Manage tab > System > Time & date
5. Click Edit NTP > select Manually configure the date and time on this host radio button.
6. Input the correct Time and Date that matches the vCenter Server time and date and click on ok button.
7. Once the time and date values matches in ESXi host and vCenter, the host can be added back to the vCenter inventory.

Additional Information

Verifying time synchronization across an ESX/ESXi host environment

The same issue, but when reconnecting an ESXI host --  Reconnect ESXi host failed with "A general system error occurred: Unable to push signed certificate to host"