VCF 9.x Import Pre-check "Failed to Retrieve Trusted Root Certificates" Due to SSO Domain Mismatch

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

During a VMware Cloud Foundation (VCF) workload domain integration, the pre-check fails with the following error in the UI: "Could not retrieve trusted root certificates from vcenter"

The domainmanager.log shows the following unauthorized error despite valid certificates and a healthy vmdir service:

Going to create a new vAPI session for vCenter <vcenter name> with username [e-mail] ... 
org.springframework.web.client.HttpClientErrorException$Unauthorized: 401 Unauthorized: "{"type":"com.vmware.vapi.std.errors.unauthenticated","value":{"error_type":"UNAUTHENTICATED","challenge":"SIGN realm="<string>",sts="https://<REDACTED_HOSTNAMES>/sts/STSService/<vCenter SSO domain name shown different than vsphere.local>", Basic realm="vCenter"","messages":[]}}" ... Could not retrieve trusted root certificates from vCenter <vcenter name>. 

Environment

VMware Cloud Foundation 9.x
VMware vCenter Server 9.x

Cause

The target vCenter is configured with a custom Single Sign-On (SSO) domain, but the workload domain integration workflow was supplied with the default [e-mail] credentials. The vAPI session fails to authenticate due to this credential mismatch, preventing SDDC Manager from retrieving the vCenter certificates.

Resolution

• Cancel the currently failed workload domain integration task in the SDDC Manager UI.

• Restart the workload domain deployment wizard or update the JSON configuration file used for the vCenter import.

• Update the vCenter SSO Username from the default [e-mail] to the correct custom SSO domain administrator account (e.g., administrator@<vCenter SSO domain>).

• Re-run the VCF import pre-check.

Additional Information

Similar failure, but logged error is for expired certificates

• "Could not retrieve trusted root certificates from vCenter" error when importing vCenter into VCF Operations 9