VASA provider registration fails with certificate error in vSphere Client

Products

• VMware vCenter Server

Issue/Introduction

• The VVOL datastore shows as inaccessible in the vCenter UI, and changing the Storage Array IP. 
• Checking the VASA provider on the host shows "Status: Offline: AuthenticationError [Vasa Provider Certificate not trusted (self-signed certificate in certificate chain)]"
• Checking the storage provider in vCenter does not show the provider registered.
• When trying to register the VASA, the provider fails with a certificate error in the vSphere client.
• vCenter - /var/log/vmware/sms/sms.log shows the following errors while creating the virtual host in the version.xml file:
  
  com.vmware.vim.binding.sms.fault.ProviderRegistrationFault: CreateVirtualHost call failed against provider with url https://array.example.com:port/vasa/version.xmlcom.vmware.vim.vasa._5_0.StorageFault: StorageFault

Environment

• VMware vSphere 7.x 
• VMware vSphere 8.x 
• VMware vSphere 9.x 

Cause

After certificate validation during provider registration, a virtual host with the vCenter IP and GUID will be created and updated in the version.xml file on the VASA provider server. If the version.xml file is not found or is corrupt, then the registration will fail with a StorageFault exception thrown by the VASA provider. 

Resolution

Verify that the version.xml file is accessible by either opening the VASA Provider URL in a web browser or running wget from the vCenter SSH session.

Note: Ensure that the required network ports for communication between the vCenter Server and the VASA Provider are open and permitted by any intervening firewalls.

You should see something similar to the following: 

<vasa-provider>
<supported-versions>
<version id="3" serviceLocation="/vasa/services/vasaService?version=2"/>
<version id="4" serviceLocation="/vasa/services/vasaService?version=3"/>
<version id="5" serviceLocation="/vasa/services/vasaService?version=4"/>
<version id="7" serviceLocation="/vasa/services/vasaService/v5"/>
</supported-versions>
</vasa-provider>

If there is no output similar to the above, involve the array vendor and verify the version.xml. 

Verify that the symlink pointing to the version.xml file exists and is valid. If the symlink is broken or incorrectly configured, VASA Provider registration may fail. Restoring the symlink should allow the registration process to complete successfully.