VMware Cloud Foundation 9.1 components do not work properly after updating the certificates with an Microsoft CA configured as an intermediate CA

Products

• VCF Operations

Issue/Introduction

In a VMware Cloud Foundation (VCF) 9.1 environment, you may experience the following symptoms:

• The Log Management component shows as "Installed" under Build -> Lifecycle -> VCF Management -> Components.
• Navigating to Operate -> Logs unexpectedly displays the default "Install Log Management" setup screen instead of the operational interface.
• Attempting to perform an environment backup result in a failure specifically for the Log Management component (other components may complete successfully).
• Log Management logs are flooded with Operations communication errors in log-processor pod logs, such as:

  com.vmware.vcf.logs.exception.OpsClientException: Ops config properties not initialized

Environment

• Log Management 9.1.x
• Fleet Lifecycle 9.1.x
• VCF Operations 9.1.x
• VCF Services Platform 9.1.x

Cause

• When an ingress TLS certificate is configured using an automated Microsoft CA URL, VCF Operations fails to process and include the intermediate CA certificate.
• As a result, the intermediate CA is missing from the platform-trust configmap (*.pem). When the Ops-Logs integration attempts to reach VMSP endpoints, it encounters an incomplete chain of trust, resulting in a silent TLS handshake error (certificate_unknown(46)) and the subsequent failure of component integrations.

Resolution

This issue is known to VMware by Broadcom. In the interim, you must bypass the automated Microsoft CA URL process and manually generate and import the full certificate chain. Follow these steps to resolve the issue:

1. Generate a CSR: Log into the VCF Operations UI as local user admin and navigate to the certificate management section to generate a new Certificate Signing Request (CSR).
2. Download the CSR: Export the generated request using the Download CSRs option.
3. Manually Generate the Certificate: Submit the downloaded CSR to your Microsoft CA to get it signed.
   Note: You must ensure that the full certificate chain (leaf, intermediate, and root) is exported from the CA.
4. Import Certificates: Return to the VCF Operations UI and upload the complete, newly signed certificate chain using the Import Certificates option.
5. Replace Certificates: Finalize the process by selecting the Replace with Imported Certificates option. This securely applies the new certificates with the complete chain of trust, resolving the TLS handshake errors and restoring Ops-Logs functionality.

Additional Information

Refer: VCF 9.1 components do not work properly after updating the certificates with an MS CA configured as an intermediate CA