Error: 'Certificate authorities update failed' when trying to add CA to vCF Instance in vCF Operations

Products

• VCF Operations

Issue/Introduction

Unable to add Certificate Authority to VCF instances in the vCF Operations UI in the web browser. Getting error: Certificate authorities update failed. 

operationsmanager.log:
Unable to retrieve Microsoft Server certificate as provided host <CA FQDN> is not valid/reachable.

Environment

vCF 9.x

Cause

Intermediate/root CA certificate not added to trust store in SDDC manager.

Resolution

Follow these steps:

1. Take snapshot of the SDDC manager
2. Obtain Intermediate/root CA certificates
3. Putty to SDDC Instance and log in with user 'vcf' and the switch to root with command 'su -'
4. Add them to trust store using the following command: keytool -import -trustcacerts -file <certificate file> -keystore /usr/lib/jvm/openjdk-java17-headless.x86_64/lib/security/cacerts -alias <certificate alias>
5. Restart services:  echo 'y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
6. Re-attempt configuring Certificate Authority in vCF Instance under Certificates page in vCF Opeations UI.