Error: Certificate thumbprint mismatch after SSL certificate change - VMware Live Site Recovery
search cancel

Error: Certificate thumbprint mismatch after SSL certificate change - VMware Live Site Recovery

book

Article ID: 412383

calendar_today

Updated On:

Products

VMware Live Recovery

Issue/Introduction

Symptoms:

The following errors occur after replacing or rotating the vCenter Server Machine SSL certificate.

  • In the vCenter UI: "com.vmware.vim.vmomi.core.exception.CertificateValidationException. Server certificate chain is not trusted and thumbprint verification is not configured."
  • In the Site Recovery UI, when attempting to establish a site pair: "Unable to connect to Lookup Service at https:/hostname/443/lookupservice/sdk. Reason: javax.net.ssl.SSLException: Certificate thumbprint mismatch."
  • Verifying the dr.log on the vSphere Replication appliance (or VMware Live Site Recovery):
    "javax.net.ssl.SSLException: Certificate thumbprint mismatch.
    com.vmware.srm.client.topology.impl.vmomi.TokenProvider$AuthenticationTokenNotAvailable: No authentication token available for SSO Server at 'https://####/sts/STSService/vsphere.local'"

Environment

  • VMware Live Recovery 9.x
  • VMware Site Recovery Manager 8.x
  • vSphere Replication 9.x

Cause

This issue occurs when the Machine SSL certificate is replaced or rotated on the vCenter Server. SRM and vSphere Replication maintain local trust stores with specific vCenter certificate thumbprints. When the vCenter certificate changes, the stored thumbprints become stale, causing SSL handshake failures during mutual authentication.

  • Validation of dr.log in vSphere Replication appliance (or from VMware Live Site Recovery) reports below. 

    [srm-reactive-thread-24966] WARN com. vmware.srm.client. infrastructure.http. BaseAsyncController #### - Request for path 'webssologin' failed.com.vmware.srm.client.topology.impl.vmomi.TokenProvider$AuthenticationTokenNotAvailable: No authentication token available for SSO Server at 'https://<####>/sts/STSService/vsphere.local
    Suppressed: com. vmware. vim. vmomi. client. exception. SslException: Unable to connect to SSO Management Server at https://<####>/
    o-adminserver/sdk/vsphere. local. Reason: javax.net.ssl. SSLException: Certificate thumbprint mismatch.
    at com. vmware. vim. vmomi. client. common. impl. ResponseImpl. setError (ResponseImpl. java: 265)
    Caused by: javax.net.ssl. SSLException: Certificate thumbprint mismatch.

  • Validation of drconfig.log reports certificate verification failed due to incorrect thumbprint. 

2026-07-08T07:00:55.669-04:00 warning drconfig[01111] [SRM@6876 sub=IO.Connection opID=####] Failed to SSL handshake; SSL(<io_obj p:0x00007f299c001ce0, h:15, <TCP '##### : ####'>, <TCP '##### : 443'>>), e: 167772294(certificate verify failed (SSL routine
s)), duration: 3msec
2026-07-08T07:00:55.669-04:00 warning drconfig[01111] [SRM@6876 sub=HttpConnectionPool-000000 opID=######] Failed to get pooled connection; <cs p:###, TCP:######:443>, SSL(<io_obj p:##### h:15, <TCP '#####
: ####'>, <TCP '####>>), duration: 5msec, N7Vmacore3Ssl18SSLVerifyExceptionE(SSL Exception: Verification parameters:
--> PeerThumbprint: ######
--> ExpectedThumbprint: #####
--> ExpectedPeerName: #######

Resolution

Follow these steps to reconfigure the appliances and restore the trust relationship:

  1. Reconfigure vSphere Replication:
  2. Reconfigure Site Recovery Manager:
  3. Reconnect Site Pair:
    • Access the vSphere Client and navigate to Site Recovery > Site Pairs.
    • Select the affected pair and click Reconnect to synchronize the new certificates across sites: Reconfiguring and Breaking Site Pairs

If you need further assistance, see Contact Support or refer to Broadcom Support Article 206567.

Additional Information

Powered by Wolken Software