Error "Invalid proxy SSL certificate" in SDDC Manager due to SSL Interception

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• In SDDC manager, attempts to configure a proxy server in SDDC Manager fail with a validation error.

The system cannot establish a secure connection because the certificate presented during the handshake is not trusted.

Error message: Can't validate proxy configuration: Error establish SSL/TLS connection to proxy. Invalid proxy SSL certificate.

• Validate SSL interception using the command: openssl s_client -proxy <PROXY_IP>:<PORT> -connect dl.braodcom.com:443

Environment

SDDC Manager 5.x

VCF 9.x

Cause

The network environment is utilizing SSL Inspection. Firewall intercepts the encrypted traffic and presents its own self-signed CA certificate to the SDDC Manager. Since the SDDC Manager trust store does not contain the firewall's Root CA, the connection is terminated to prevent a suspected Man-in-the-Middle (MitM) attack.

Resolution

To resolve this issue, the SDDC Manager must be able to verify the certificate chain for Broadcom depots. Use one of the following methods:

Method 1: SSL Inspection Bypass

Involve internal Network Security team to create an SSL Inspection bypass (whitelist) domain *dl.broadcom.com on the firewall/proxy.This allows the SDDC Manager to receive the original, globally trusted certificates directly from the source.

Method 2: Import Firewall CA to SDDC Manager Trust Store

If SSL interception is mandatory, add the firewall’s Root CA certificate to the SDDC Manager's trusted authorities by obtaining the Root CA certificate from your Network Administrator.

Refer to How to add/delete Custom CA Certificates to SDDC Manager and Common Services trust stores - VMware Cloud Foundation for adding the certificate to the SDDC Manager trust store.

Additional Information

Proxy certificate can be obtained using the below command via ssh. Refer to Lifecycle Manager fails with "The download source dl.broadcom.com is invalid or cannot be reached now." due to ssl interception

• For Authenticated proxy:
  
  read -s -p "Proxy Password: " PROXY_PASS && echo && PROXY_PASS=$PROXY_PASS openssl s_client -connect dl.broadcom.com:443 -proxy <proxy_address>:<proxy_port> -proxy_user "<username>" -proxy_pass env:PROXY_PASS -showcerts < /dev/null


• For Transparent proxy:
  
  openssl s_client -proxy <proxy_address>:<proxy_port> -connect dl.broadcom.com:443