Error: "Failed to gather dependent backups" when creating a manual or automatic backups

Products

• VMware Cloud Director

Issue/Introduction

• In VMware Cloud Director Availability (VCDA) when you login on the provider portal you get red banner with the message:
  
  The last 3 scheduled backup tasks have failed due to 'Failed to gather dependent backups.' Go to Backup Archives to check your configuration.
  
  
  
• When you go to the backup Archives in Scheduled backup archives under Scheduled backup tasks you can see tasks failed with error:
  
  Error:  "Failed to gather dependent backups"
  
  
  
• On the vCDA manager appliance in /opt/vmware/h4/cloud/log/cloud.log you can see entries similar to:
  
  ERROR - [UI-########-####-####-####-############-####-##] [job-29] com.vmware.h4.jobengine.JobExecution     : Task ########-####-####-####-############ (WorkflowInfo{type='generate', resourceType='backup', resourceId='########-####-####-####-############', isPrivate=false, resourceName='null'}) has failed
com.vmware.h4.exceptions.common.FailedToGatherDependentBackupsException: Failed to gather dependent backups.

2026-01-07 07:09:29.045 DEBUG - [UI-########-####-####-####-############-####-##] [job-29] c.vmware.h4.jobengine.lock.LockManager   : Released lock id: backup, lock: Lock{currentOwner=########-####-####-####-############, count=1, candidates=[]}
2026-01-07 07:09:29.072  WARN - [UI-########-####-####-####-############-####-##] [job-37] c.v.r.health.HealthCheckingFactory       : Closing resource due to an onCreated handler failure
com.vmware.exception.GenericSSLException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Environment

VMware Cloud Director Availability 4.7

Cause

This issue occurs because the tunnel certificate has been replaced but the Cloud service in VCDA has not been reconnected to the Tunnel service.

Resolution

To fix this issue reconnect the tunnel to the cloud service in VCDA

1. Log in to the management interface of the Cloud Director Replication Management Appliance.
   1. In a Web browser, go to https://Appliance-IP-Address/ui/admin.
   2. Select Appliance login or SSO login and enter the root or the single sign-on user credentials.
   3. Click Login.
2. In the left pane under Configuration, click Settings.
3. Under Service Endpoints next to Tunnel Service address, click Edit.
4. In the Tunnel Service Settings window, click Apply.
5. Verify the thumbprint and accept the new Tunnel Service SSL certificate.

For more information about replating the tunnel certificate follow the documentation Replace the SSL certificate of the Tunnel Service