Unable to license standalone Aria Automation Orchestrator

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

1. Licensing errors on a standalone Orchestrator instance persist even after using the steps discussed in the following KBs:
   • 402 Error It appears that you subscription has expired or about to expire message when logging into VMware Aria Automation/ Orchestrator
   • Error "Your subscription has expired. The core product operations are unavailable" is seen after upgrading to Aria Automation/Aria Orchestrator 8.18.x
   • vSphere Authenticated Aria Orchestrator 8.18.x fails to login with Error ${message}
2. The UI intermittently displays a banner stating Your subscription has expired. The core product operations are unavailable. Please contact your Account Manager or Customer Success Manager to renew your license, and requires an environment restart to restore functionality so workflows can run successfully.

3. The following entry appears in the /services-logs/prelude/vco-app/vco-server-app.log file:

   2025-08-19T17:13:58.939Z ERROR vco [host='vco-app-##########-#####' thread='licenseComplianceScheduler-1' user='' org='' trace=''] {} com.vmware.vim.sso.client.impl.SoapBindingImpl - SOAP fault
   com.sun.xml.ws.fault.ServerSOAPFaultException: Client received SOAP Fault from server: EndTime: Tue Aug 19 17:13:54 GMT 2025 is not after startTime: Tue Aug 19 17:13:58 GMT 2025 Please see the server log to find more detail regarding exact cause of the failure.

   The vCenter logs show corresponding entries for the above call:

   2025-08-19T17:13:58.909Z INFO sts[88:tomcat-http--50] [CorId=########-####-####-####-############] [com.vmware.identity.sts.ws.handlers.SOAPHeadersExtractor] Found 1 
   (clipped)
   2025-08-19T17:13:58.928Z ERROR sts[88:tomcat-http--50] [CorId=########-####-####-####-############] [com.vmware.identity.sts.ws.StsServiceImpl] java.lang.IllegalArgumentException: EndTime: Tue Aug 19 17:13:54 GMT 2025 is not after startTime: Tue Aug 19 17:13:58 GMT 2025\n\tat com.vmware.identity.util.TimePeriod. [com.vmware.identity.sts.ws.SOAPFaultHandler] Returning a SOAP Fault with code: ns0:RequestFailed and description: EndTime: Tue Aug 19 17:13:54 GMT 2025 is not after startTime: Tue Aug 19 17:13:58 GMT 2025

Environment

Aria Orchestrator 8.18.1 with vSphere authentication enabled

Cause

The service account certificate has expired at the time the call is made. There is likely an issue concerning the trigger of the service account update and the token renewal being unsynchronized for a short period of time.

Resolution

1. Apply the following workaround to give more time for the account token synchronization to take place. Apply the following property in vRO:

   vracli vro properties set -k "com.vmware.o11n.sso.svcaccount.ephemeral-cert-lifetime-ms" -v "7776000000"

2. If the above does not resolve the issue, add the following system property to the ephemeral-certificate property:

   com.vmware.o11n.authentication.sts.SamlTokenService.retryRenew with a value of true.

   vracli vro properties set -k "com.vmware.o11n.authentication.sts.SamlTokenService.retryRenew" -v "true"