Error: CA Server URL not reachable during Microsoft CA integration in SDDC Manager
search cancel

Error: CA Server URL not reachable during Microsoft CA integration in SDDC Manager

book

Article ID: 442495

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

  • The integration of Microsoft Certificate Authority on the SDDC manager fails with :

    CA Server URL not reachable: Unable to get certificate

  • The operationsmanager.log reports a CERTIFICATE_GET_FAILED error with the message "unable to get certificate".
  • Testing the connection using curl -v https://<CA_FQDN>/certsrv shows the connection defaults to port 80 but connects successfully over HTTP as seen below. 
#curl -v http://<CA_FQDN>/certsrv:443
Host <CA_FQDN>:80 was resolved.
* IPv6: (none)
* IPv4: ##.##.##.##
*
Trying ##.##.##.##:80 ...
* Established connection to <CA_FQDN> (##.##.##.## port 80) from ##.##.##.## port 3####
using HTTP/1.X
> GET /certsrv:443 HTTP/1.1
> Host: <CA_FQDN>
> User-Agent: curl/8.16.0
> Accept: */*
* Request completely sent off
< HTTP/1.1 400 Bad Request
< Cache-Control: private
< Content-Type: text/html; charset=utf-8
< Server: Microsoft-IIS/10.0
< X-AspNet-Version: 4.0.30319
< X-Powered-By: ASP.NET
< Date: Mon, 25 May 2026 11:37:59 GMT
< Content-Length: 3490
v
<! DOCTYPE html>
<html>
<head>

Environment

VCF 5.2.x 

Cause

The Microsoft CA server is configured with only an HTTP (port 80) binding and lacks an HTTPS (port 443) binding, which prevents the exchange of server certificates. SDDC Manager requires a connection to the CA server via port 443 (HTTPS) to receive and validate a valid server certificate. When the connection defaults to port 80 (HTTP) due to a missing HTTPS binding, no SSL/TLS handshake occurs, causing SDDC Manager to throw the "Unable to get CERTIFICATE" error.

Resolution

To resolve the issue. 

  1. Open IIS Manager on your CA server (go to Start > Windows Administrative Tools > Internet Information Services (IIS) Manager).
  2. In the Connections pane, expand the server name and expand Sites.
  3. Click on Default Web Site (or the specific site hosting your CA Web Enrollment, such as CertSrv).
  4. In the Actions pane on the far right, click Bindings....
  5. In the Site Bindings window, click Add.
  6. Select type https.
  7. Under SSL certificate, select the valid certificate for this CA (ensure you verify the selected certificate for validity).
  8. Click OK.
  9. From the SDDC Manager UI, navigate to configure the Certificate Authority and click Save.
  10. The SDDC Manager will prompt with a pop-up of the CA server certificate; accept the certificate.
Powered by Wolken Software