VCF 9 Installation Validation Fails: Failed to install certificates on VCF Installer

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

• After running the VCF installer wizard, the installation validation starts and fails with the following errors on the UI when attempting attempting to validate the connectivity with the VCF Automation. 

Failed to install certificates on VCF Installer: The provided thumbprints for the following products do not match with their actual thumbprints. Products: [vcf_automation.##### ].
Remediation: Check the validity of the certificates provided in the input specification
Error connecting to ESX Host esxi1.#####. 
Remediation: Ensure that ESX Host esxi1.example.com.is responsive
Error connecting to ESX Host esxi2.#####. 
Remediation: Ensure that ESX Host esxi2.example.com is responsive
Error connecting to ESX Host esxi3.example.com. 
Remediation: Ensure that ESX Host esxi3.##### is responsive
Error connecting to ESX Host esxi4.example.com. 
Remediation: Ensure that ESX Host esxi4.##### is responsive
VCF installer and the ESX servers are all in the same VLAN

• The /var/log/vmware/vcf/domainmanager.log reports the following correlated errors

YYYY-MM-DDTHH:MM:SS  INFO  [vcf_dm,68f9ba6922c8de4c0bb7431dfbb2fabd,49a5] [c.v.e.s.v.a.InstallCertificatesOnInstallerAction,dm-exec-16] Product SSL mismatch: user-provided: <#############>, actual: <#############> 
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,68f9ba60de100d4bd2d73067dbba9025,a92f] [c.v.evo.sddc.common.util.SshKeyScan,dm-exec-12]  Getting SSH host key with algorithms ssh-ed25519 from <#############>:22
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,68f9ba60de100d4bd2d73067dbba9025,a92f] [c.v.e.s.c.util.LocalProcessService,dm-exec-12]  Executing the local command: ssh -p 22 -o HostKeyAlgorithms=ssh-ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/tmp/############ -o PasswordAuthentication=no -o BatchMode=yes <#############>@<#############>.  2>/dev/null
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,68f9ba60de100d4bd2d73067dbba9025,a92f] [c.v.e.s.c.util.LocalProcessService,dm-exec-12]  Local command  ssh -p 22 -o HostKeyAlgorithms=ssh-ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/tmp/<#############> -o PasswordAuthentication=no -o BatchMode=yes <#############>@<#############>.  2>/dev/null failed with exit value 255
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,68f9ba60de100d4bd2d73067dbba9025,a92f] [c.v.e.s.c.util.LocalProcessService,dm-exec-12]  Error Output: ssh: connect to host <#############>:22: Connection refused
YYYY-MM-DDTHH:MM:SS ERROR [vcf_dm,68f9ba6922c8de4c0bb7431dfbb2fabd,49a5] [c.v.e.s.v.a.InstallCertificatesOnInstallerAction,dm-exec-16]Failed to install certificates on VCF Installer appliance
com.vmware.evo.sddc.orchestrator.exceptions.OrchTaskException: The provided thumbprints for the following products do not match with their actual thumbprints. Products: VCF_AUTOMATION_FQDN.        at com.vmware.evo.sddc.validation.action.InstallCertificatesOnInstallerAction.validateBrownfieldThumbprints(InstallCertificatesOnInstallerAction.java:189)
        at com.vmware.evo.sddc.validation.action.InstallCertificatesOnInstallerAction.populateBrownfieldProductsTrust(InstallCertificatesOnInstallerAction.java:124)
        at com.vmware.evo.sddc.validation.action.InstallCertificatesOnInstallerAction.execute(InstallCertificatesOnInstallerAction.java:82)

 

 

Environment

VMware Cloud Foundation 9.x

Cause

The primary cause is an incorrect certificate thumbprint provided for a target component, VCF Automation, within the VCF installer input specification JSON file.

 

 

Resolution

To resolve the issue: 

1. On the VCF Installer UI where the validation failed, locate and use the option to download the current input specification JSON file.
2. Open the downloaded JSON file using a standard text editor.
3. Locate the JSON block defining the component referenced in the UI error (e.g., VCF Automation).
4. Retrieve the actual, valid SHA-256 certificate thumbprint directly from the target appliance.
5. Replace the incorrect thumbprint value in the JSON file with the newly retrieved, valid thumbprint.
6. Save the modifications to the JSON file.
7. Return to the VCF Installer UI, upload and import the corrected input specification JSON, and restart the validation wizard.
8. To address the secondary ESXi connection failures, ensure the SSH service (TSM-SSH) is in a Running state and port 22 is accessible on all target ESXi hosts prior to initiating validation.

Additional Information

Use a JSON Specification File to Deploy VMware Cloud Foundation or vSphere Foundation