[400] An error occurred while sending an authentication request to the vCenter Single Sign-On server - An error occurred when processing the metadata during vCenter Single Sign-On setup premature end of file

Products

• VMware SDDC Manager / VCF Installer
• VMware vCenter Server

Issue/Introduction

• vCenter UI reports below,

[400] An error occurred while sending an authentication request to the vCenter Single Sign-On server - An error occurred when processing the metadata during vCenter Single Sign-On setup, premature end of file

Environment

vCenter 8.x

VCF 5.x 

Cause

This issue may be caused by expired or invalid STS certificates, or because the signing root certificate has expired. An expired STS certificate prevents internal services and solution users from acquiring valid tokens, causing them to fail as expected.

Resolution

NOTE: If the vCenter Server is standalone, ensure you take a snapshot. If the servers are in linked mode, power off all vCenter servers within the same SSO domain before taking snapshots.

Procedure to replace the STS signing certificate,

Use the new and improved certificate management tool - vCert - Scripted vCenter Expired Certificate Replacement - for all certificate management/replacement workflows. 

1. Download and install vCert on the vCenter Server Appliance as described in the Installation Section.
2. To check the STS signing certificate:
   1. Use Option 8 -  View STS signing certificates from the menu 2:  View Certificate Info
3. To replace the STS signing certificate:
   1. Use the Option 8 - STS signing certificates from the menu 3: Manage Certificates.
   2. After STS certs have been renewed, enter to return to previous menu
   3. option 8. Restart services

Additional Information

For more information on viewing the STS certificate and determining the expiry date, see Checking Expiration of STS Certificate on vCenter Server.