Enhanced Replication Mappings Error: Fault occurred while performing health check. Details: 'Connect: certificate verify failed (SSL routines).

Products

VMware Live Recovery

Issue/Introduction

When testing the Enhanced Replication Mappings Before/After changing certificates on the Replication Appliance/vCenter server, the error observed is: Error:Fault occurred while performing health check. Details: 'Connect: certificate verify failed (SSL routines)'
Connection to ports 31031 and 32032 from source host to target host connects successfully.
# nc -zv ##.##.##.## 31031
Connection to ##.##.##.##31031 port [tcp/*] succeeded!
# nc -zv ##.##.##.## 32032
Connection to ##.##.##.## 33032 port [tcp/*] succeeded!
From vSphere Replication, /opt/vmware/hms/logs/hms.log will display error with VM in replication as below:

2025-10-10 00:56:48.618 INFO com.vmware.hms.vlsi.step.InvocationStep [tcweb-14] (..vlsi.step.InvocationStep) [] | vmomiOp-start [method: HmsGroup.getExtendedInfo; target: GID-####-####-####-####-####-HMS-####; user: ####; client: ##.##.##.##:33586; operationID=####-####-####-####-####-HMS-####; sessionID=BD1BD4DF]
2025-10-10 00:56:48.619 INFO com.vmware.hms.i18n.class com.vmware.hms.response.filter.I18nActivationResponseFilter [tcweb-14] (..response.filter.I18nActivationResponseFilter) [operationID=####-####-####-####-####-HMS-####-HMS-####,sessionID=BD1BD4DF] | The localized message is: A replication error occurred at the vSphere Replication Server for replication 'vm-name'. Details: 'No connection to VR Server for virtual machine vm-name on host host-name in cluster cluster-name: Unknown'.
The issue is usually observed after vCenter certificate replacement

Environment

VMware Live Recovery 9.x

Cause

This issue occurs due to a certificate mismatch between the vSphere Replication services (hbrsrv and hms) and the vCenter Server, which prevents the services from establishing a secure connection.

The mismatch is typically triggered by one of the following recent environmental changes:

A recent certificate renewal on the vCenter Server or the replication appliance.
The application of a "disallowed host" tag to specific hosts within the cluster.

When either of these changes occurs, the hbrsrv and hms services fail to fetch the updated trust anchors. Because they continue to rely on cached, invalidated certificate chains, the secure handshake with vCenter Server fails.

From vSphere Replication, /opt/vmware/hms/logs/hms.log while performing mappings test - "SSL certificate output will be invalid and will not match the actual SSL endpoint"

####-##-## ##:##:##.548 DEBUG com.vmware.hms.net.HbrAgentHealthMonitorService [hms-main-thread-1510] (..hms.net.HbrAgentHealthMonitorService) [] | Ping test execution result for host 'host-#####', group 'PING-GID-####-####-####-####-#####', hbrBroker: '(hms.HbrBrokerEndpoint) {
dynamicType = null,
dynamicProperty = null,
ipAddress = Target vSphere Replication Appliance IP,
lwdPort = 31031,
lwdsPort = 32032,
certificate = -----BEGIN CERTIFICATE-----
From ESXi, /var/run/log/hbr-agent.log there is an event for "Certficate verify failed"

####-##-## ##:##:##.165Z In(166) hbr-agent-bin[2107446]: [0x000000bd451ec700] info: [Proxy [Group: GID-####-####-####-####-####] -> [##.##.##.##:32032] Bound to vmk: vmk5 for connection to ##.##.##.##:32032
####-##-## ##:##:##.166Z In(166) hbr-agent-bin[2107446]: [0x000000bd450ea700] info: [Proxy [Group: GID-####-####-####-####-####] -> [##.##.##.##:32032] TCP Connect latency was 583Âµs
####-##-## ##:##:##.168Z In(166) hbr-agent-bin[2107446]: [0x000000bd4516b700] error: [Proxy [Group: GID-####-####-####-####-####] -> [##.##.##.##:32032] SSL handshake failed: certificate verify failed (SSL routines)
####-##-## ##:##:##.168Z In(166) hbr-agent-bin[2107446]: [0x000000bd4516b700] error: [Proxy [Group: GID-####-####-####-####-####] -> [##.##.##.##:32032] Failed to connect to server ##.##.##.##:32032 using broker info: certificate verify failed (SSL routines)
####-##-## ##:##:##.168Z In(166) hbr-agent-bin[2107446]: [0x000000bd4516b700] error: [Proxy [Group: GID-####-####-####-####-####] -> [##.##.##.##:32032] Exhausted all server endpoints reported by broker.

Resolution

Restart the hbr-agent and hbrsrv services on all ESXi hosts involved in the replication mappings: Restarting the management agents in ESXi
Restart the hbrsrv and hms services on both the source and target vSphere Replication Appliances: Start, stop, and restart vSphere Replication Appliance services
In the vCenter UI, navigate to Site Recovery Plugin > Open Site Recovery > View Details > Enhanced Replication Mappings and run all tests to confirm success.

If the issue persists, Please contact Broadcom Support: Contact Broadcom Support