Error: The console proxy certificate is not trusted when launching VM consoles in VMware Cloud Director

Products

• VMware Cloud Director
• VMware Telco Cloud Infrastructure

Issue/Introduction

• When attempting to launch a Virtual Machine (VM) web console in the VMware Cloud Director (VCD) Tenant Portal, the console fails to open and may display the following:
• Error: "The console proxy certificate is not trusted"
• The console window remains blank or shows "Disconnected, Retry."
• Browser developer tools show a WebSocket connection failure (WSS) to a legacy URL or port (e.g., port 8443).

Environment

VCD: 10.3.3.2

TCI: 2.3

Cause

This issue occurs due to a configuration mismatch where the Console Proxy Base URL utilizes a legacy prefix or non-standard port (8443), or when the underlying ESXi host certificates are not trusted within the VCD certificate store after a renewal.

Resolution

Step 1: Unify Console Proxy and HTTP Port
VMware Cloud Director 10.4 and later deprecates the dedicated Console Proxy port (8443). Consolidate the connection to port 443 to avoid separate certificate failures.

1. Log in to the VMware Cloud Director provider portal as a system administrator.
2. Navigate to Administration > Public Addresses.
3. Edit the Console Proxy settings.
4. Update the Base URL to use the primary VCD cell FQDN (remove legacy prefixes).
5. Change the Port to '443'.
6. Click Save.

Step 2: Establish Trust for Infrastructure Certificates
Establish a trust anchor between VCD and the ESXi hosts to allow encrypted console streams to validate.

1. Navigate to Administration > Certificate Management > Trusted Certificates.
2. Click Test Remote Connection.
3. Enter the FQDN of the ESXi host where the VM resides (e.g., 'https://esxi-host.domain.com').
4. Click Connect, then Retrieve the certificate.
5. Click Trust Selected to add the certificate to the VCD trust store.
6. Repeat for other impacted hosts, or use the cell management tool to trust all infrastructure certificates:
   ./cell-management-tool trust-infra-certs --vsphere --unattended