SSL Trust Mismatch reported by VDT on vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• When running VDT, the results show "SSL Trust Mismatch" or "A single certificate has a trust mismatch."
• In the VDT output and logs you see a similar message:

SSO Checks
A single certificate has a trust mismatch.  This requires an execution of lsdoctor.py with the –trustfix flag on this vCenter server node.
                • [FAIL]    <vcenter-server-FQDN> (VC Server or CGW)
                    [FAIL]    SSL Trust Mismatch
                                Please run python lsdoctor.py --trustfix option on this node (or a vCenter in this SSO site).
                                Services grouped by SSL Trust: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:
                                - sso:groupcheck
                                - sso:admin
                                - sso:sts

                                     ...

Environment

vCenter

Cause

SSL Trust or Anchor Mismatches typically result from expired certificates, broken trust chains, or unsuccessful certificate replacements.

Resolution

To resolve the issue:

1. Take a snapshot and/or backup of the vCenter (powered off snapshots of all vCenters if using ELM)
2. Copy and extract lsdoctor to the vCenter filesystem
3. Run the command “python lsdoctor.py -t”
4. Provide the password for your SSO administrator account
5. Once the script completes, restart vCenter services on all nodes in the SSO domain

Follow up actions needed:

• Re-register any external solutions that were previously pointed to the affected node(s) (SRM, vSphere Replication, NSX-T, etc.)

Additional Information

The lsdoctor tool can be downloaded here: Using the 'lsdoctor' Tool

• This KB also contains more details about using or running the tool.

https://knowledge.broadcom.com/external/article/344917/using-the-vcf-diagnostic-tool-for-vspher.html