Replacing Certificates in SDDC Manager API does not complete and hangs SDDC Manager

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

Attempting to replace certificates using the SDDC Manager API (as documented in SDDC Manager API > Certificates > Replace Resource Certificates), either through API Explorer or other REST platform, returns a HTTP Code 200 but does not complete and hangs processes in SDDC Manager

Environment

VMware SDDC Manager

Cause

Documentation references for replacing certificates via API are unclear and reference inappropriate formatting of the JSON body for the REST call. 

Resolution

Please use the correctly formatted payload i.e. ONE object per host using one of below formats (Note: replace the values in the below examples with the appropriate values for your environment):

 

Option 1 - Using certificateChain

[
  {
    "resourceFqdn": "sfo-vc01.rainpole.io",
    "certificateChain": "<leaf cert + CA chain in single PEM string>"
  }
]

(or)

Option 2 - Using resourceCertificate + caCertificate:

[
  {
    "resourceFqdn": "sfo-vc01.rainpole.io",
    "resourceCertificate": "<leaf certificate only>",
    "caCertificate": "<CA certificate chain>"
  }
]

Additional Information

• SDDC Manager API ResourceCertificateSpec: https://developer.broadcom.com/xapis/sddc-manager-api/latest/data-structures/ResourceCertificateSpec/
• Certificates need to be in single PEM string, this means all line breaks need to be replaced by the `\n` escape sequence to keep the single line formatting, like so (Note: full certificates should be used, this example uses ellipses for brevity and to keep true certificates secure)

"-----BEGIN CERTIFICATE-----\nMIIFq...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFq...\n-----END CERTIFICATE-----"