Error: "CA Key Usage Check Failed: keyCertSign Bit Is Not Set" while replacing custom SSL certificate for SDDC Manager

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• The process for rotating or replacing SSL certificates within SDDC Manager fails to complete.
• The /var/log/vmware/vcf/operationsmanager/operationsmanager.log contains the following error:Certificate chain validity check against current PKIXParameters failed java.security.cert.CertPathValidatorException: CA key usage check failed: keyCertSign bit is not set

Environment

• VMware Cloud Foundation
• SDDC Manager

Cause

The Certificate Authority (CA) certificate in the chain is misconfigured. According to X.509 standards, any certificate used to sign other certificates (Root or Intermediate) must have the keyCertSign bit asserted in its "Key Usage" extensions.

Resolution

The Certificate Authority (CA) certificate is misconfigured and must be recreated with the keyCertSign bit enabled. 

1. Verify the CA certificate using OpenSSL command. 
   openssl x509 -in <CA_certificate_file> -text -noout
2. Check the X509v3 Key Usage section. If Certificate Sign (or keyCertSign) is missing, the certificate is invalid for signing purposes.
3. Request a new CA certificate with the keyCertSign extension enabled from the PKI administrator.
4. Reassemble the PEM chain and reattempt the certificate replacement in SDDC Manager.