Converged VCF Deployment receives error "Failed to install VMCA Certificate on SDDC Manager".

Products

• VMware Cloud Foundation

Issue/Introduction

• When attempting to deploy a converged VCF instance, the deployment receives the error."Failed to install VMCA Certificate on SDDC Manager".
• Review the following log files for confirmation:

• • /var/log/vmware/vcf/commonsvcs/vcf-commonsvcs.log

ERROR [common,############,####] [c.v.e.s.a.u.utils.SslCertValidator,http-nio-127.0.0.1-7100-exec-6] Cert Validation failed
java.security.cert.CertPathValidatorException: Could not validate certificate signature.
        at org.bouncycastle.jcajce.provider.RFC3280CertPathUtilities.processCertA(Unknown Source)
        at org.bouncycastle.jcajce.provider.PKIXCertPathValidatorSpi_8.engineValidate(Unknown Source)
        at java.base/java.security.cert.CertPathValidator.validate(CertPathValidator.java:309)
        at com.vmware.evo.sddc.appliance.utilities.utils.SslCertValidator.validateCertChain(SslCertValidator.java:240)
        at com.vmware.evo.sddc.appliance.utilities.utils.SslCertValidator.validateCertsInChain(SslCertValidator.java:144)
        at com.vmware.evo.sddc.appliance.utilities.utils.SslCertValidator.performERICertValidations(SslCertValidator.java:135

• • /var/log/vmware/vcf/domainmanager/domainmanager.log

INFO  [vcf_dm,############,####] [c.v.e.s.s.InstallSddcManagerVmcaCertificateLocalAction,dm-exec-13]  Installing SDDC Manager VCSA certificate
ERROR [vcf_dm,############,####] [c.v.e.s.s.InstallSddcManagerVmcaCertificateLocalAction,dm-exec-13]  API failure during install certificate Code: 500, error: {"errorCode":"CERT_REPLACEMENT_FAILED","arguments":[],"message":"Cannot replace existing certificate with the input cert. Validations did not pass.\nMake sure the input cert chain is valid. The structure must be:\n\#####server cert\##### followed by \#####intermediate certs\##### followed by \#####CA cert\#####\nOR\nA self signed server cert\nAll certs in the chain must conform to X.509 standards.\nAlso make sure that the DNS name in both the CN field and the optional Subject Alternative Name extension, is a resolvable hostname","causes":[{"type":"com.vmware.evo.sddc.appliance.utilities.error.CertValidatorException","message":"Cannot replace existing certificate with the input cert. Validations did not pass.\nMake sure the input cert chain is valid. The structure must be:\n\#####server cert\##### followed by \#####intermediate certs\##### followed by \#####CA cert\#####\nOR\nA self signed server cert\nAll certs in the chain must conform to X.509 standards.\nAlso make sure that the DNS name in both the CN field and the optional Subject Alternative Name extension, is a resolvable hostname"}],"referenceToken":"#####"}

Environment

VCF 9.x

Cause

When the VMCA certificate is configured as an intermediate CA, leading to certificate state inconsistency or corruption in the SDDC Manager certificate chain

Resolution

To resolve this, revert the VMCA to the default self-signed root using the certificate-manager CLI:

1. Connect to vCenter CLI and launch the certificate manager utility by running the command.
   
   /usr/lib/vmware-vmca/bin/certificate-manager
   
   
2. Option 4 or option 8 The certificate-manager CLI should be invoked to revert VMCA to the default self-signed root. For more information, refer to Using vSphere Certificate Manager to Replace SSL Certificates
3. Once the certificates are reset, re-run the VCF installer or upgrade to allow the converge operation to proceed.