Error: '500 Internal Server Error' when trying to access VM console from VMware Cloud Director

Products

• VMware Cloud Director

Issue/Introduction

• Accessing Virtual Machine (VM) console in VMware Cloud Director(VCD) fails with the below API call:

POST https://<VCD-URL>/api/vApp/vm-<VM-ID>/screen/action/acquireMksTicket

Error: Unable to collect webmks token

• The acquireMksTicket API call is failing with the the below response in HAR file.
  
  stackTrace="com.vmware.vcloud.api.presentation.service.TicketAugmentationException: An error occurred when acquiring a screen ticket.
at com.vmware.vcloud.vapp.impl.VAppServiceImpl.augmentMksTicket(VAppServiceImpl.java:1160)
at com.vmware.vcloud.vapp.impl.VAppServiceImpl.acquireMksTicketInfo(VAppServiceImpl.java:972)
...
...
Caused by: com.vmware.consoleproxy.ticket.AugmentationException: Unable to determine public endpoint certificate chain
at com.vmware.consoleproxy.ticket.impl.EncryptionTicketThumbprintAugmentation.augmentTicket(EncryptionTicketThumbprintAugmentation.java:109)
at com.vmware.vcloud.vapp.impl.VAppServiceImpl.augmentMksTicket(VAppServiceImpl.java:1156)
Caused by: com.vmware.consoleproxy.ticket.AugmentationException: Unable to determine public endpoint certificate chain
at com.vmware.consoleproxy.ticket.impl.EncryptionTicketThumbprintAugmentation.getThumbPrint(EncryptionTicketThumbprintAugmentation.java:69)
at com.vmware.consoleproxy.ticket.impl.EncryptionTicketThumbprintAugmentation.augmentTicket(EncryptionTicketThumbprintAugmentation.java:102)
message="[ ##########-####-####=####-########## ] An error occurred when acquiring a screen ticket. - Unable to determine public endpoint certificate chain" majorErrorCode="500" minorErrorCode="TICKET_AUGMENTATION"/>
  
  
• Console access fails across all VMs from the VCD UI.
• Unable to take VM's console.
• VM Console states "Connecting.... RETRY"
• Cannot launch web and remote console for VM from VCD level. 
• You can see the below error messages from /opt/vmware/vcloud-director/logs/vcloud-container-debug.log :

ERROR    | pool-jetty-8054           | VAppServiceImpl                | Encountered error while trying to augment cloned ticket for vm <vm moref> | requestId=########-####-####-####-####5045,request=POST https://<vcd-fqdn>/api/vApp/vm-<vm-id>/screen/action/acquireMksTicket,requestTime=########,remoteAddress=##.##.##.##:####,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=application/*+xml;version 39.0
com.vmware.consoleproxy.ticket.AugmentationException: Unable to determine public endpoint certificate chain
        at com.vmware.consoleproxy.ticket.impl.EncryptionTicketThumbprintAugmentation.augmentTicket(EncryptionTicketThumbprintAugmentation.java:109)
        at com.vmware.vcloud.vapp.impl.VAppServiceImpl.augmentMksTicket(VAppServiceImpl.java:1156)
        at com.vmware.vcloud.vapp.impl.VAppServiceImpl.acquireMksTicketInfo(VAppServiceImpl.java:972)
        at jdk.internal.reflect.GeneratedMethodAccessor7578.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)

Environment

VMware Cloud Director 10.6.x

Cause

This issue is caused by a missing or incorrectly associated public certificate in the Public Addresses section of the VCD Provider UI. 

Resolution

To resolve the issue, ensure that the SSL certificate used by the load balancer or public endpoint is uploaded and correctly associated in the Public Addresses section of the Cloud Director provider interface.

Steps to Fix:

1. Log in to the VCD Provider UI.

2. Navigate to: Administration > Settings > Public Addresses.

3. Click Edit.

4. Upload the correct SSL certificate used by the load balancer for console access (REST/console proxy).

5. Click Save.

After completing this configuration, MKS ticket generation should succeed and VM consoles will be accessible via the UI.

Additional Information

Configure VMware Cloud Director Public Addresses