Active Directory logins to vCenter fail after LDAPS certificate renewal

Products

• VMware vCenter Server

Issue/Introduction

• Users are unable to log in to the vCenter Server vSphere Client using Active Directory (AD) credentials. Logins using local SSO accounts (e.g., [email protected]) continue to work.
• Authentication failures are also observed in any backup jobs that uses an AD account.
• This issue commonly occurs after the SSL certificate on the external Active Directory Load Balancer or Domain Controller (the LDAPS provider) has been renewed or changed.

Environment

• VMware vCenter Server

Cause

• Active Directory logins fail because vCenter retains an outdated, cached certificate that mismatches the newly renewed certificate presented by the Active Directory Load Balancer.

Resolution

The solution is to re-add the Identity Source configuration in vCenter with the new certificate. This requires you to log in using a local SSO administrator account (like [email protected]).

Warning: Before removing the identity source, take the Snapshot of vCenter depending on Stand alone or linked mode, if it's Linked Mode, power off Snapshot is mandatory. take screenshots of all its settings (Primary server URL, Base DN for users, Base DN for groups, etc.) also need to re-add your AD groups to vCenter roles (under "Global Permissions" or other objects) after re-adding the source.

1. Obtain the New AD Certificate. Follow the steps below to to generate .cer file.
   1. Take Putty/SSH access to the vCenter using "root" credential and execute the command below 

      openssl s_client -connect <DC_FQDN_OR_IP>:636 -showcerts

   2. Save the Certificate as .cer file.
2. Remove and re-add the identity source.
   1. Log in to the vSphere Client as [email protected]
   2. Navigate to Menu > Administration > Single Sign On > Configuration > Identity Sources.
   3. Select the problematic AD identity source and click Remove.
   4. Click Add to create a new identity source.
   5. Select Active Directory over LDAP.
   6. Fill in all the same configuration details you noted down.
   7. When you reach the Certificates (for LDAPS) section, upload your new certificate file which was generated before
   8. Click Save to apply the changes 
3. Make the AD login as "default login" on Single Sign on screen and try to login to vCenter with AD/SSO user name and credential.

Additional Information

KB 383112: AD Authentication Failure in vCenter Due to LDAPS Certificate Mismatch

KB 316596: Configuring a vCenter Single Sign-On Identity Source using LDAP with SSL (LDAPS)

Reference : Add or Edit a vCenter Single Sign-On Identity Source