vCenter adapter instance showing "down" in Aria Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• The vCenter adapter instance in the Aria Operations UI displays a "Warning" state with an "Object Down" status. The associated error message states: "Unable to connect to VC".

• Despite the "Down" status, basic network connectivity tests from the Aria Operations nodes to the vCenter Server are successful:
  
  ping <vCenter ip address> 
curl -v telnet://<vCenter ip address:443>
  
  
• In /storage/log/vcops/log/adapters/VMwareAdapter/<Adapter_Instance_ID>.log, the following SSL exception is recorded:
  
  com.integrien. adapter. vmware.VMwareAdapter.initializeVimClient - Unable to connect to VC https://<vCenter ip address>/sdk
com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException:PKIX path building failed: sun.security. provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Environment

Aria Operations 8.18.x

Cause

The root cause is confirmed to be a L7 application inspection on network path between the Aria Operations nodes and the vCenter Server endpoint.

Although Layer 3 (Ping) and Layer 4 (Telnet) connectivity are successful, the L7 inspection interferes with the SSL handshake in a way that the Aria Operations does not recognize the certificate presented by vCenter, resulting in the PKIX path building failed error.

Resolution

To resolve this issue, disable L7 Application Inspection for traffic between the Aria Operations nodes and the vCenter Server on the intermediate firewall or security appliance.

Once the inspection is disabled:

1. The SSL handshake will complete successfully.
2. Data collection will resume between the two endpoints.
3. Adapter status will return to Green/Online.
4. Generated reports and dashboards will populate with current data.