VCF/VVF 9.x: VMware Remote Console (VMRC) 13.1.0 fails to connect to VMs with error message: Buffer too small

Products

• VMware vCenter Server
• Remote Console
• VMware Cloud Foundation
• VMware vSphere Foundation

Issue/Introduction

• When attempting to open a remote console session to a Virtual Machine using VMware Remote Console (VMRC) the application abruptly terminates during the connection phase with error message:
  
  

  CRITICAL vmrc.exe 16544 [ws@4413 threadName="vmrc"] PANIC: bora\lib\string\str.c:283 Buffer too small

• The target virtual machine is running on an ESXi host version 9.x within a VCF or VVF environment.
  
  
• ESXi certificate contains a multi-level certificate.

Environment

VCF/VVF 9.0.x

VCF/VVF 9.1.0

VMRC 13.x

Cause

This is a known issue affecting VMRC 13.x. on VVF/VCF 9.x environments

Resolution

A fix to this issue will be implemented to a future release.

Workaround: 

Modify the ESXi host's SSL certificate file to remove the appended CA chain, leaving only the required leaf certificate:

Steps to apply the workaround:

1. Identify the ESXi host where the affected Virtual Machine is currently registered and running.

2. Log in to the ESXi Shell, either directly from the DCUI or from an SSH client, as a user with administrator privileges.

3. In the directory /etc/vmware/ssl, rename the existing certificates using the following commands.

   cd /etc/vmware/ssl/
   

4. CRITICAL: Create a backup of the existing certificate before making any modifications:

   cp rui.crt rui.crt.backup
   

5. View the contents of the certificate to confirm it contains a multi-level chain:

   cat rui.crt
   

   You will notice multiple blocks of text starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----. The very first block is the ESXi host's leaf certificate. Any subsequent blocks are the chained CA certificates.

6. Open the certificate file in a text editor, such as vi:

   vi rui.crt
   

7. Carefully delete all text after the very first -----END CERTIFICATE----- tag.

   • Ensure that no trailing spaces or empty lines remain after the first block's end tag.

   • The file should now contain exactly one BEGIN and END block.

8. Save and exit the file (in vi, press Esc, type :wq, and press Enter).

9. Restart the management agents on the ESXi host to force it to load the corrected certificate payload:
   
   

   /etc/init.d/hostd restart && /etc/init.d/vpxa restart

10. Once the host reconnects to vCenter, launch VMRC and connect to the Virtual Machine. The connection will now succeed.