Deployment of OVF Fails with error " A Fatal error has occurred. Unable to continue"

Products

• VMware vCenter Server

Issue/Introduction

When deploying an OVF template in a vCenter Server 9.x environment, the deployment fails immediately with the following error:
A fatal error has occurred. Unable to continue.

The following errors are observed in the logs : 

/var/log/vmware/content-library/cls.log:

       YYYY-MM-DD | ERROR    | misqihwt-####-auto-####-h5:70022227 | tomcat-http-40            | AuthorizationFilter            | Could not retrieve permission information for ID urn:vmomi:ResourcePool:resgroup-13:####-254d-####-b458-#### for operation com.vmware.vcenter.ovf.import_session.create_for_resource_pool.
       com.vmware.vsphere.common.authz.AuthorizationException: Could not validate with CIS Authz service

       YYYY-MM-DD  | DEBUG    | misqihwt-####-auto-####-h5:70022231 | tomcat-http-45            | AuthorizationFilter            | Validating permissions for 2 objects, in invocation of com.vmware.vcenter.ovf.import_session.create_for_resource_pool
       YYYY-MM-DD  | DEBUG    | misqihwt-####-auto-####-h5:70022231 | tomcat-http-45            | AuthorizationServiceClientimpl | Operation: hasPrivileges. Invoking server API.
       YYYY-MM-DD  | WARN     | misqihwt-####-auto-####-h5:70022231 | tomcat-http-45            | AuthorizationServiceClientimpl | Operation: hasPrivileges. Read API execution failed.
       java.util.concurrent.ExecutionException: com.vmware.vim.binding.vmodl.RuntimeFault: Unable to dispatch request: Failed to create session

/var/log/vmware/vpxd/vpxd.log:

       YYYY-MM-DD  error vpxd[06787] [Originator@6876 sub=Default] received error code 401 for [N7Vmacore4Http23Http1ClientResponseImplE]: Unauthorized
       YYYY-MM-DD  info vpxd[06787] [Originator@6876 sub=Default] Creating SideCar HTTP/2 ConnectionPool
       YYYY-MM-DD  warning vpxd[06787] [Originator@6876 sub=ResourceMonitor] Failed request to VAPI service; Error:
       -->    com.vmware.vcenter.tokenservice.invalid_request
       --> Messages:
       -->    com.vmware.vcenter.tokenservice.exceptions.InvalidRequest<Failed to built JWT_ID token for {Name: vpxd-svc-acct-####-6a2a-4937-a573-####, Domain: VSPHERE.LOCAL} on behalf of {Name: vpxd-svc-acct-####-6a2a-4937-a573-####, Domain: VSPHERE.LOCAL}>

 

Environment

VCF 9.x

Cause

This issue is caused by time synchronization drift on the vCenter Server.Starting with vCenter Server 9.x, internal service-to-service authentication relies on JSON Web Tokens (JWTs) issued by the vCenter Token Service. JWT validation is highly dependent on accurate system time.
If the vCenter system clock is out of sync, the Token Service cannot validate the Issued At (iat) and Expiration (exp) claims within the JWT. As a result, authentication requests fail with HTTP 401 Unauthorized, preventing the OVF Import Session from being created and causing the deployment to fail.

Resolution

To resolve this issue, ensure that time is synchronized across the environment by configuring NTP servers.

1. Log in to the vCenter Server Management Interface (VAMI) at https://<vcenter-ip-or-fqdn>:5480.

2. Navigate to the Time section.

3. Click Edit under Time Settings.

4. Change the Mode to NTP and enter valid NTP server addresses.

5. Ensure the Time synchronization status shows as "In sync."

6. Once the clocks are synchronized, retry the OVF deployment.