VCF 9.1 components do not work properly after updating the certificates with an MS CA configured as an intermediate CA

Products

• VCF Operations

Issue/Introduction

When the configured Microsoft CA is an intermediate CA to another root CA in VCF 9.1, replacing component certificates will either fail or lead to issues in the component.

• vCenter certificate replacement error:
  • vc.cert.replacement.error  Certificate task REPLACE_CERTIFICATE for ##### has failed. Error message: vCenter Certificate replacement task failed.
Bulk Task ID: #####,ReplaceCertTask ID: ######. Exception: Failed to execute request PUT https://<FQDN>/api/vcenter/certificate-management/vcenter/tls with exception
{"error_type":"ERROR","messages":[{"args":["No issuer certificate for certificate in certification path found."],"default_message":
"Exception found (No issuer certificate for certificate in certification path found.)","id":"com.vmware.certificatemanagement.error"}]}


• ESX certificate replacement error:
  • esx.cert.replacement.error
Certificate task REPLACE_CERTIFICATE for '####' has failed. Error message: Unexpected error during certificate replacement for for bulkTakId = #####, subTaskId = ##### on ESXi host #####. Cannot change the host configuration.
    
    Note: The ESX cert replacement completes but the host immediately disconnects from vCenter with the error: "Authenticity of the host's SSL certificate is not verified."
    
    
• NSX certificate replacement fails with
  • certificate.upload.error
Certificate task REPLACE_CERTIFICATE for ##### has failed. Error message: Unable to upload certificate against CSR ID ###### on NSX for replace certificate operation with error message : Certificate chain validation failed. Make sure a valid chain is provided in order leaf,intermediate,root certificate.. Please check VIM adapter logs and task status for more details.
    
    
• SDDC Manager replacement error
  • unexpected.response.code
Certificate task REPLACE_CERTIFICATE for '####' has failed. Error message: Failed to perform specified operation on SDDC manager. Following conditions do not match - The Certificate Chain '#####' validation failed due to 'Signature does not match.'
    
    
• VCF Operations, VCF Networks, and VCF Automation replacement fails with the error:
  • certificate.replace.failed
Certificate task REPLACE_CERTIFICATE for <FQDN> has failed. Error message: Certificate chain is not valid.
    
    
• vIDB replacement completes, but VCF SSO becomes unavailable as a login option.
  
  
• VMSP replacement completes, but the effects are not yet known.
  
  
• VCF Management lists Log Management as an installed component but the Operate > Logs has the default Install Log Management page

Environment

• VCF 9.1
•  Log Management 9.1 
• VCF Services Platform (VMSP)

Cause

This is a known issue affecting VCF 9.1 GA.

Resolution

This issue is fixed in VCF Operations 9.1.0.0200. See the Release Notes for more information

 

To workaround this issue in VCF Operations 9.1.0.0000 and 9.1.0.0100, see the steps below.

For any certificate that has been replaced or needs to be replaced with this Microsoft CA should be done manually:

1. Generate a CSR from VCF Ops UI
2. Download the CSR using Download CSRs option
3. Generate the Certificate by manually taking the CSR to the Microsoft CA to get signed. Ensure the full certificate chain is exported.
4. Import the certificates to VCF Ops using Import Certificates option.
5. Use Replace with Imported Certificates option to replace the certificate. 

Note: If the certificates do not update in the browser/UI immediately after the manual import reboot the Component VM and retry the steps above.