Provider method implementation threw unexpected exception when refreshing STS Signing Certificate - vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

When attempting to renew or refresh the STS Signing Certificate in a vCenter Server environment (typically Enhanced Linked Mode), the process fails with the following error:

Provider method implementation threw unexpected exception: https://<PSC-FQDN>:443/api/ invocation failed with "java.net.UnknownHostException: <PSC-FQDN>"

Environment

VMware vCenter Server 8.x

Cause

The STS renewal process attempts to validate the refresh against all nodes registered in the SSO domain. If the domain contains metadata for a node that has been decommissioned, retired, or is otherwise unreachable, the validation fails.

Resolution

To resolve this issue, a "Force Refresh" must be performed to bypass the validation of unreachable nodes.

Note: Ensure you have snapshots or backups of your vCenter environment. Ref: VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

1. Navigate to the STS Certificate management section.
2. Select the option to refresh the certificate.
3. Check the Force Refresh checkbox (this allows the process to ignore communication failures with stale nodes).
4. Once the certificate is updated on the primary node, you must restart services on every node in the Enhanced Linked Mode environment to ensure the new certificate is recognized: service-control --stop --all && service-control --start --all