VCF SSO login to WLD vCenter fails with HTTP 400 - Bad Request on /ui/login/oauth2/authcode after a MACHINE_SSL_CERT replacement

Products

• VMware vCenter Server

Issue/Introduction

• vCenter UI displays: HTTP Status 400 – Bad Request on the /ui/login/oauth2/authcode page.
• VCF Operations task failure: vCenter Certificate replacement task failed.
• Error logs indicate: Failed to notify APPLMGMT on http://localhost:1080/api/appliance/certificates/notification.
• Component configuration fails with: Failed to fetch the auth source for vCenter

Environment

VMware Cloud Foundation 9.1

Cause

During the certificate replacement workflow, the trust relationship or authentication source between VCF Operations and the Workload Domain vCenter can become desynchronized, particularly if the applmgmt service on the vCenter appliance fails to acknowledge the new certificate.

Resolution

1. Perform the following steps to re-establish the trust:

   1. Log in to the vCenter Server Appliance via SSH as root and restart management services: service-control --restart applmgmt systemctl restart vami-lighttpd (or cap-lighttpd depending on version).
   2. Log in to VCF Operations.
   3. Navigate to Identity & Access > VCF Instances.
   4. Select the relevant instance and go to Component Configuration.
   5. Select the Workload Domain vCenter and click Deregister Component.
   6. In the same view, select the vCenter again and click Configure Component.
   7. Follow the on-screen instructions to complete the SSO registration.

   For the initial "Failed to notify APPLMGMT" error, refer to Replacement of vCenter Server Certificates Using the API Reports "Failed to notify APPLMGMT"

Additional Information

Users should subscribe to this article for updates regarding automated fix implementations in future maintenance releases. See How to Subscribe to a Knowledge Base Article.