"Failed to retrust AUTOMATION truststore" is returned during vCenter Certificate Replacement using VCF Operations UI
search cancel

"Failed to retrust AUTOMATION truststore" is returned during vCenter Certificate Replacement using VCF Operations UI

book

Article ID: 441506

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

  • After a successful certificate replacement on a vCenter component in VMware Cloud Foundation (VCF) Operations 9.1, the automated post-update re-trust step for VMware Aria Automation fails

  • The VCF Operations UI reports: "Failed to retrust AUTOMATION truststore (errorCode=certificate.retrust.error)"

  •  /storage/log/vcops/logs/vcops-bridge-<uuid>.log reports,

    YYYY-MM-DDTHH:MM:SS INFO vcfops-bridge [...threadName="TasksManager-TaskHandler-..."] [com.vmware.vcops.bridge.server.vcf.certificate.task.SddcTaskResponseHandler.handleResult] - Got the results from Controller <nmp-task-id>, result: VcfCertificateGenericTaskResult( taskId=<task-id>, taskResponseResult=VcfCertTaskApplianceDetails{applianceIpOrFqdn='<vcenter-fqdn>', applianceType='VCENTER'}, taskStatus=FAILED, errors=[VcfCertError(message=Failed to retrust AUTOMATION truststore, errorCode=certificate.retrust.error)] )

  • API calls would have worked for VCF 9.0.x but failed in VCF 9.1 GA

  • /storage/log/vcops/log/ManagementAdapter_<instance>.log reports,

    YYYY-MM-DDTHH:MM:SS  ERROR ManagementAdapter 26343 [ops### threadId="###" threadName="TasksManager-AsyncNMPTaskThread--2" instanceId="##"] [(81) com.vmware.adapter.management.components.certificate.manager.RetrustUtil.uploadCertificateToVcfa] - Error importing certificate to VCFA FQDN: 400 BAD_REQUEST - {"minorErrorCode":"VCD_###","message":"Single certificate required but a certificate chain was provided","stackTrace":"com.vmware.vcloud.api.rest.toolkit.exceptions.BadRequestRestApiException: Single certificate required but a certificate chain was provided\n\tat com.vmware.vcloud.api.rest.openapi.impl.ssl.TrustedCertificatesApiHandler.apiModelToSpec(TrustedCertificatesApiHandler.java:206)\n\tat com.vmware.vcloud.api.rest.openapi.impl.ssl.TrustedCertificatesApiHandler.trustCertificate(TrustedCertificatesApiHandler.java:132)..."}

    YYYY-MM-DDTHH:MM:SS ERROR ManagementAdapter 26343 [ops@### threadId="###" threadName="TasksManager-AsyncNMPTaskThread--2" instanceId="##"] [(81) com.vmware.adapter.management.components.certificate.manager.RetrustUtil.importCertificateToVcfa] - Failed to import certificate to VCFA:FQDN
    YYYY-MM-DDTHH:MM:SS ERROR ManagementAdapter 26343 [ops@### threadId="###" threadName="TasksManager-AsyncNMPTaskThread--2" instanceId="##"] [(81) com.vmware.adapter.management.components.certificate.CertificateComponent.invokeRetrustCertificateAction] - Failed to retrust for FQDN to trust VCENTER
    YYYY-MM-DDTHH:MM:SS ERROR ManagementAdapter 26343 [ops@### threadId="###" threadName="TasksManager-AsyncNMPTaskThread--2" instanceId="##"] [(81) com.vmware.adapter.management.components.certificate.util.CertUtil.updateErrorDetailsInTask] - certificate.retrust.error

Environment

  • VMware Cloud Foundation (VCF) Operations 9.1
  • VMware Aria Automation (formerly vRealize Automation)

Cause

When VCF Operations completes a certificate replacement, it automatically attempts to update the trusted-certificates store on each connected component. During the retrust phase for Aria Automation (VCFA), VCF Operations sends the CA certificate. VCFA requires that certificates are imported one at a time. If the CA chain includes intermediate certificates, the automated retrust incorrectly submits the entire multi-level chain as one payload, causing VCFA to reject it.

Resolution

Broadcom is aware of this issue. A permanent fix is planned for a future release.

Note: Aria Automation version 9.0 and newer generally does not require this re-trust step for connectivity. The workaround below is only necessary if connectivity between Aria Automation and vCenter is broken.

Workaround: Manual Certificate Trust

  1. Log in to the VMware Aria Automation UI as a provider administrator.
  2. Navigate to Infrastructure → Connections → Cloud Accounts.
  3. Locate the vCenter cloud account corresponding to the vCenter where the certificate was replaced.
  4. Click Edit on that cloud account.
  5. When the "Invalid Certificate" prompt appears, click Accept or Re-trust to import the new certificate thumbprint.
  6. Click Save.
  7. Verify the cloud account status is OK.

For further assistance, see Contact Support. Scroll to the bottom of the page and click on your respective region.

Additional Information

Reference KB: Aria Automation and Orchestrator Connection Issues After vCenter Certificate Update

Powered by Wolken Software