Machine SSL certificate replacement fails with Invalid PEM format error
search cancel

Machine SSL certificate replacement fails with Invalid PEM format error

book

Article ID: 421558

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

  • Replacing Machine SSL certificate from Certificate Management in vSphere Client fails with error "not a valid PEM formatted Machine SSL certificate".



  • vSphere Client logs shows error messages as below :

    /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log

    [YYYY-MM-DDTHH:MM:SS.###Z] [ERROR] tp-nio-127.0.0.1-5090-exec-6  com.vmware.vise.mvc.exception.GlobalExceptionHandler              Exception handled while processing request for /ui/certificate-ui/ctrl/certificates/tls:  com.vmware.vapi.std.errors.Error: Error (com.vmware.vapi.std.errors.error) => {
        messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
        id = com.vmware.certificatemanagement.error,
        defaultMessage = Exception found (Invalid input, not a valid PEM formatted Machine SSL certificate),
        args = [Invalid input, not a valid PEM formatted Machine SSL certificate],
        params = <null>,
        localized = <null>

  • Certificate Management service logs shows error messages as below :

    /var/log/vmware/certificatemanagement/certificatemanagement-svcs.log

    YYYY-MM-DDTHH:MM:SS.###Z [tomcat-exec-10 [] INFO  com.vmware.certificatemanagement.impl.tls.TlsReplace  opId=] Entering replace method to replace the TLS/SSL certificate ..
    YYYY-MM-DDTHH:MM:SS.###Z [tomcat-exec-10 [] ERROR com.vmware.certificatemanagement.impl.tls.TlsReplace  opId=] Invalid PEM string for MACHINE_SSL certificate malformed PEM data encountered
    YYYY-MM-DDTHH:MM:SS.###Z [tomcat-exec-10 [] ERROR com.vmware.certificatemanagement.impl.tls.TlsReplace  opId=] TLS Certificate replacement failed : Invalid input, not a valid PEM formatted Machine SSL certificate
    YYYY-MM-DDTHH:MM:SS.###Z [tomcat-exec-10 [] ERROR com.vmware.certificatemanagement.vapi.impl.TlsProviderImpl  opId=] Exception was thrown while executing set:
    com.vmware.certificatemanagement.impl.exceptions.InvalidArgumentException: Invalid input, not a valid PEM formatted Machine SSL certificate
            at com.vmware.certificatemanagement.impl.tls.TlsReplace.replaceMachineCert(TlsReplace.java:97) ~[service-0.0.1-SNAPSHOT.jar:?]

Environment

VMware vCenter Server

Cause

This issue occurs when the Machine SSL Certificate file used in the certificate replacement wizard is corrupted, encoded in binary (DER) format, or contains hidden formatting characters (often from being edited in rich-text editors). vCenter requires Base-64 encoded X.509 (PEM) format.

Resolution

To resolve this issue, you must ensure the certificate is correctly exported and sequenced.

1. Export the Certificate as Base-64

  1. Open the certificate file on a Windows desktop by double-clicking it.
  2. Click on the Details tab.
  3. Click Copy to File to open the Certificate Export Wizard.
  4. Click Next.
  5. Select Base-64 encoded X.509 (.CER) and click Next.
  6. Specify a file path and click Next, then Finish.

2. Verify the Certificate Chain Order Open your .pem or .cer file in a plain text editor (e.g., Notepad++ or VS Code). Ensure the certificates are stacked in the following top-down order with no empty lines:

  1. Machine SSL Certificate
  2. Intermediate CA Certificate(s)
  3. Root CA Certificate

Example Structure:

-----BEGIN CERTIFICATE----- <Machine SSL Certificate> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <Intermediate CA Certificate> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <Root Certificate> -----END CERTIFICATE-----

3. Use the exported Base-64 formatted file during Certificate Replacement Wizard.

4. Refer to Add Custom Certificates Using the vSphere Client. for the steps to import and replace the certificate in vSphere UI

Additional Information

  • The Machine SSL Certificate file should have below order for Intermediate and Root CA

    UI Screenshot for machine ssl file upload:


    -----BEGIN CERTIFICATE-----
    <alphanumeric certificate characters>       <-----Machine SSL Certificate
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    <alphanumeric certificate characters>       <-----Intermediate 1 Certificate
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
     <alphanumeric certificate characters>      <-----Intermediate 2 Certificate
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
     <alphanumeric certificate characters>      <-----Root Certificate
    -----END CERTIFICATE-----

  • The "Root Chain" certificate file should be in below order for Intermediate and Root CA

    UI Screenshot for root chain file upload:


    -----BEGIN CERTIFICATE-----
    <alphanumeric certificate characters>       <-----Intermediate 1 Certificate
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
     <alphanumeric certificate characters>      <-----Intermediate 2 Certificate
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
     <alphanumeric certificate characters>      <-----Root Certificate
    -----END CERTIFICATE-----
Powered by Wolken Software