Unable to configure vSphere HA due to expired certificates on ESXi host.

Products

• VMware vCenter Server 8.0

Issue/Introduction

• After upgrading to vCenter Server 8.0.3, HA enabled clusters fail to configure, and only the primary HA host remains active.  
• vCenter server is not able to initialize vSphere HA on the secondary hosts due to a communication error.
• The host /var/run/log/fdm.log records certificate verification errors and SSL handshake failures, similar to the following:
  • YYYY-MM-DDThh:mm:ss warning fdm[########] [Originator@#### sub=IO.Connection opID=WorkQueue-####] Failed to SSL handshake; SSL(<io_obj p:0x########, h:9, <TCP '##.###.##.## : #####'>, <TCP '##.###.##.## : #####'>>), e: 336134278(certificate verify failed (SSL routines, 5513 get server_certificate)), duration: 5mmec 
YYYY-MM-DDThh:mm:ss error fdm[########] [Originator@#### sub=Message opID=WorkQueue-####] Error N7VMacore3S5118SSLVerifyExceptionE(SSL Exception: Verification parameters: 
--> PeerThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
--> ExpectedThumbprint: 
--> ExpectedPeerName: <ESXi Host Name>
--> The remote host certificate has these problems: 
--> 
--> * certificate has expired) 
--> [context]################################[/context] on handshake 
YYYY-MM-DDThh:mm:ss error fdm[########] [Originator@#### sub=Message opID=clusterElection.cpp:##-####] AsyncConnect failed
YYYY-MM-DDThh:mm:ss info fdm[########] [Originator@#### sub=Message opID=clusterElection.cpp:##-####] Destroying connection
YYYY-MM-DDThh:mm:ss error fdm[########] [Originator@#### sub=Cluster opID=clusterElection.cpp:##-####] Couldn't connect to master N7Vmacorel6Timeout

Environment

• VMware vCenter Server Appliance 8.0 U3

Cause

• In vCenter server 8.0 U3 and later, By default the vpxd.certmgmt.mode is set to "vmca"
  • Self Signed Certificates on ESXi host are no longer supported by vCenter.
• The vCenter Server is unable to communicate with the ESXi host because the host's SSL certificates are invalid or expired, which prevents the vSphere HA agent from establishing a secure connection.

 

Resolution

To resolve this issue, the host certificate must be renewed via the VMware Certificate Authority (VMCA).

1. Log into the vSphere Client.
2. Navigate to Configure > Settings > Advanced Setting
3. Select Edit Settings.
   • Use the filter to locate vpxd.certmgmt.mode ,see Change the ESXi Certificate Mode for more details.
   • Ensure the value is set to vmca (If set to custom or thumbprint, the vCenter Server will not automatically refresh host certificates).
4. Now, select the affected cluster from the inventory.
5. Configure Distributed Resource Scheduler (DRS) to Manual state to prevent automated virtual machine migrations during remediation.
6. Disable vSphere HA on the cluster.
7. Remediate host certificates:
   • Select each host with an expired certificate, navigate to Configure > System > Certificate, and select Refresh or Renew to rotate the SSL certificates via the vCenter Server.
8. Enable vSphere HA on the cluster to re-initialize and redeploy the FDM agents across the newly secured host endpoints.
9. Reconfigure the DRS setting back to its original Fully Automated state.

Additional Information

vSphere HA clusters fails to configure in vCenter Server 8.0 U3 when the VPXD certificate mode is set to "thumbprint".