Configuring Online Depot settings on SDDC Manager fails with error "Failed to connect to VMware depot with the provided user credentials. Cause: {0}" due to SSL Inspection

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

• When attempting to configure the Online Depot settings in the SDDC Manager UI (Administration > Depot Settings), authentication fails even when valid Broadcom credentials and download tokens are provided.
  
  
• The UI displays the error:
  "Failed to connect to VMware depot with the provided user credentials. Cause: {0}."


• The /var/log/vmware/vcf/lcm/lcm-debug.log file contains the following exception: 
  "sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetA"


• Manual connection test using curl -kv https://dl.broadcom.com may succeed (due to the -k insecure flag), but a standard curl or openssl connection fails with certificate validation error.

Environment

VMware Cloud Foundation

SDDC Manager.

Cause

• The issue is caused by SSL Inspection (Deep Packet Inspection) on the local network firewall or proxy server.
• When SDDC Manager connects to dl.broadcom.com, the network security device intercepts the SSL traffic and replaces the original Broadcom/DigiCert certificate with its own CA certificate. Since the certificate authority used by the inspection device is not trusted by the SDDC Manager's Java trust store, the SSL handshake fails and the connection is blocked as a security precaution against potential Man-in-the-Middle (MitM) attacks.

Resolution

Follow the steps below to configure the SDDC Manager to trust the intercepting network appliance:

1. SSH to the SDDC Manager as vcf, elevate to root and run the following command to identify the issuer of the certificate being presented:
   openssl s_client -connect dl.broadcom.com:443 -showcerts
   
   (Review the Issuer line. If it lists a corporate firewall or proxy instead of a public CA (like DigiCert), SSL inspection is active.)
   
   
2. Upload the certificate to the SDDC Manager (e.g., /tmp/root_chain.cer) using an SCP utility.
   
   
3. Obtain the trusted certificates key by issuing the following command:
   pass=$(cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key)
   
   
4. Import the certificate into the trusted_certificates_store with the keytool:
   keytool -importcert -alias new_mgmt_root -file /tmp/root_chain.cer -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $pass
   
   
5. Import the certificate into the cacerts store:
   keytool -importcert -alias depot_root -file /tmp/root_chain.cer -keystore /etc/alternatives/jre/lib/security/cacerts --storepass changeit
   
   
6. Verify the new certificate has been successfully added:
   keytool -list -v -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $pass | less
   
   
7. Refresh the trusted certificates using the API from the SDDC Manager:
   curl -X POST localhost/appliancemanager/trustedCertificates/refresh

 

Alternative Workaround:

Reach out to the Network Security team to implement an SSL Decryption Bypass (Whitelist) for the domain dl.broadcom.com. This allows the SDDC Manager to receive the original trusted certificate directly from Broadcom, bypassing the need for manual certificate imports.