After upgrading vCenter in an Enhanced Linked Mode environment, plugin downloads fail with the error “No issuer certificate for certificate in certification path found.”

Products

• VMware vCenter Server

Issue/Introduction

• This issue occurs in an Enhanced Linked Mode (ELM) environment.
  
  
• The error occurs when different versions of vCenter exist within the ELM, such as during a version upgrade.
  
  
• This error occurs in vCenter prior to the upgrade.
  
  
• The following error is logged in the `vsphere_client_virgo.log` file
  
  Example:
  

  --------
  Downloading plug-in package 'com.vmware.lcm.client:8.0.3.600' to '/etc/vmware/vsphere-ui/vc-packages/vsphere-client-serenity/com.vmware.lcm.client-8.0.3.600/plugin-package.tmp' has failed due to unknown reasons. Removing failed plugin package folder '/etc/vmware/vsphere-ui/vc-packages/vsphere-client-serenity/com.vmware.lcm.client-8.0.3.600'. org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
  --------
  DOWNLOAD_FAILED: Error downloading plugin package com.vmware.lcm.client:8.0.3.600 from https://<VC_FQDN>:443/lcm-ui/plugin.zip. Reason: Download error. Make sure that the URL is reachable and the thumbprint is correct.
  --------
  No issuer certificate for certificate in certification path found.
  --------

Environment

VMware vCenter Server 8.x
Enhanced Linked Mode environment

Cause

The pre-upgrade vCenter failed to validate the certificate chain of the post-upgrade vCenter.
This is caused by a temporary version mismatch resulting from the update process on the vCenter within the ELM environment.

Resolution

Complete the version upgrade on all vCenters within the ELM environment and ensure they are all on the same version.

Additional Information

Japanese KB: 拡張リンクモード環境で vCenter をバージョンアップしたあとにプラグインのダウンロードが "No issuer certificate for certificate in certification path found." エラーで失敗する