ESXi host failing to send Enhanced Replication to target site

Products

• VMware Live Recovery

Issue/Introduction

ESXi host is failing to send any replications to target ESXi while using enhanced replication. 

Seeing errors in Enhanced Replication Mappings:
Fault occurred while performing health check. Details: 'FindServer: Failed Thumbprint and certificate is not allowed to send replication data thumbprint

Same error will occur in hbr-agent.log on ESXi host

Environment

ESXi 8.0 u2 and above
vSphere Replication 9.x and above

Cause

• ESXi host certificate is being rejected by vSphere Replication or is missing on target vSphere replication appliance 
• ESXi host certificate is mismatched between the hbr service and the hms service in vSphere replication

Resolution

Step 1: Reconfigure vSphere replications on both site and reconnect site pair. If the error remains the same , proceed for Step 2

Step 2 : Verify if ESXi host thumbprint and certificate are present in hbr and hms database on replication appliance

• Validate host-id of ESXi host in question by selecting the ESXi host in the vCenter inventory and finding the host-xxx number in the URL
• Access SSH to vSphere replication appliance and sudo root account on both Protected and Recovery appliances
• Verify the thumbprint in the hbrsrv database on both sides:
  To determine the working db
        pre version 9.0.3    -  /usr/bin/hbrsrv-bin --print-default-db
        post version 9.0.3  -   /opt/vmware/hbr/bin/hbrsrv --print-default-db
  
  
  • For pre version 9.0.3
         echo -e "select * from HostInfo where hostid = 'host-xxx';"  | sqlite3 /etc/vmware/hbrsrv.xx.db
    
    
  • For post version 903 and onwards
        echo -e "select * from HostInfo where hostid = 'host-xxx';" | sqlite3 /opt/vmware/etc/hbr/hbrsrv.xx.db
     
•  
• Verify the ESXi host thumbprint with the following command:
  • openssl s_client -connect esxifqdn:443 | openssl x509 -noout -fingerprint -sha256

The thumbprint output from the openssl command should match the output of the sql command from both Replication Appliances. 

If the thumbprint does not match or is missing on one or both locations Change ESXI host certificate and restart services on Replication Appliance

Additional Information

Alternate method of finding Host-ID