Unable to add an older version of ESXi Host to vCenter server: Certificate Thumbprint Verification Timeout

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to add an older version of ESXi host to VMware vCenter via the web client, the operation fails with a timeout. The vCenter server GUI does not present an option to accept the certificate thumbprint, preventing the host from joining the cluster.

The following error is displayed in the recent tasks or error logs: 

"Login to host [IP_Address] failed. The certificate on 1 host could not be verified. The SHA1 thumbprints of the certificate is listed below. To continue connecting, manually verify this certificate and accept the thumbprint below."

Environment

VMware vSphere 8.x

Cause

vCenter server cannot automatically validate the SSL certificate of the ESXi host. This is likely to occur with hosts that are running older versions of ESXi, resulting in certificates that are expired, using outdated hashing algorithms (like SHA1), or are self-signed and untrusted by the modern vCenter server appliance.

Resolution

Required to bypass the GUI timeout by using VMware PowerCLI to force the connection.

Prerequisites:

1. A workstation with VMware PowerCLI installed.
2. Network access to both the vCenter Server and the ESXi host.
3. root credentials for the ESXi host (Service accounts may fail this specific operation; the direct root account is required).

Steps:

1. Launch PowerShell as an Administrator.
2. Connect to the vCenter Server: 

   Connect-VIServer -Server <vCenter_FQDN_or_IP>

3. Add the Host using the -Force parameter:
   Run the following command, ensuring you use the root user for the host credentials. 

   Add-VMHost -Name <Host_IP_Address> -Location "<Cluster_Name>" -User root -Password <Root_Password> -Force

   Note: The -Force switch automatically accepts the host's certificate thumbprint, bypassing the verification step that caused the GUI to hang.
4. Verify Connectivity: Check the vCenter server web client - The ESXi host should now appear in the inventory.

Additional Information

Refer: VMware PowerCLI Reference: Add-VMHost Command

This cmdlet adds a host to be managed by a vCenter Server system. The host is added to the datacenter or folder specified by the Location parameter.

 

If the issue persists, the certificate on the ESXi host could be corrupt. SSH into the ESXi host and regenerate the certificates using /sbin/generate-certificates followed by a restart of the management agents (/etc/init.d/hostd restart and /etc/init.d/vpxa restart).