cmsso-util domain-repoint fails at "Updating registry settings" with Vdcpromo Error 9127 due to TLS interception on Port 636

Products

• VMware vCenter Server

Issue/Introduction

• Attempting to join a vCenter Server to an Enhanced Linked Mode (ELM) replication partner using the cmsso-util domain-repoint command fails during the final stages.
• The console output shows the process failing specifically at the registry update step:
  cmsso-util domain-repoint -m execute --src-emb-admin Administrator --replication-partner-fqdn <Replication_Partner_FQDN> --replication-partner-admin Administrator --dest-domain-name <destination_domain_name>
  

  All Repoint configuration settings are correct; proceed? [Y|y|N|n]: Y

  Starting License export                                                         ... Done
Starting Authz Data export                                                      ... Done
Starting Tagging Data export                                                    ... Done
Export Service Data                                                             ... Done
Uninstalling Platform Controller Services                                       ... Done
Stopping all services                                                           ... Done
Updating registry settings                                                      ... Failed

• /var/log/vmware/cloudvm/cmsso_util.log on the Source vCenter Server reports the following: 
  

  YYYY-MM-DDTHH:MM:SS INFO cmsso_util RC = 1
Stderr = YYYY-MM-DDTHH:MM:SS  password:
YYYY-MM-DDTHH:MM:SS  Initializing Directory server instance ...
Vdcpromo failed. Error[9127]
Could not connect to VMware Directory Service via LDAP.
Verify VMware Directory Service is running on the appropriate system and is reachable from this host.

  YYYY-MM-DDTHH:MM:SS <class 'cis.baseCISException.BaseInstallException'>
YYYY-MM-DDTHH:MM:SS  Exception: Traceback (most recent call last):
  File "/usr/lib/vmware-vmafd/firstboot/vmafd-firstboot.py", line 184, in main
    controller.firstboot()
  File "/usr/lib/vmware-vmafd/firstboot/vmafd-firstboot.py", line 55, in firstboot
    self.init()
  File "/usr/lib/vmware-vmafd/firstboot/vmafd-firstboot.py", line 61, in init
    service.init()
  File "/usr/lib/vmware-vmafd/firstboot/identityinstall/vmdirInstall.py", line 406, in init
    self.setup_domain()
  File "/usr/lib/vmware-vmafd/firstboot/identityinstall/vmdirInstall.py", line 258, in setup_domain
    raise self.utils.createInstallException(
cis.baseCISException.BaseInstallException: {
    "detail": [
        {
            "id": "install.vmafd.vmdir_vdcpromo_error_23",
            "translatable": "Could not connect to VMware Directory Service via LDAP. Verify VMware Directory Service is running on the appropriate system and is reachable from this host.",
            "localized": "Could not connect to VMware Directory Service via LDAP. Verify VMware Directory Service is running on the appropriate system and is reachable from this host."
        }
    ],
    "componentKey": "vmafd",
    "problemId": "install.vmafd.vmdir_vdcpromo_error_23",
    "resolution": {

• Verify that the required ports, i.e 389, 636, 2012, 2020, 8084 are open between all vCenter(s) by running the below command from vCenter_A to vCenter_B and vice versa: 
  curl -v telnet://<target_ip_or_fqdn>:<port_number>
• Running a cryptographic connection test using curl shows the connection hangs at the Client Hello phase and never receives a TLS Server Hello or Certificate over port 636.
  
  • The command is run on the destination vCenter Server to check the TLS connectivity with the source vCenter Server:
    
    root@<vcenter> [ ~ ]# curl -v https://<Source_vCenter_IP>:636
*   Trying <Source_vCenter_IP>:636...
* ALPN: curl offers http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
(Command hangs here)
• A successful output looks like the following: 
  • curl -v https://<IP_Address_Of_Another_vCenter>:636
*   Trying <IP_Address_Of_Another_vCenter>:636...
* ALPN: curl offers http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* closing connection #0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

Environment

VMware vCenter Server

Cause

This issue occurs because  network security devices such as a firewall, Load Balancer, or Intrusion Prevention System situated between the vCenter Servers is actively interfering with the TLS cryptographic handshake over Port 636.

Resolution

Remove any TLS interception, SSL decryption, or Deep Packet Inspection blocking port 636 between the vCenter Servers. Once the network allows the TLS handshake to complete successfully, re-run the cmsso-util domain-repoint command:

• cmsso-util domain-repoint -m execute --src-emb-admin Administrator --replication-partner-fqdn <Replication_Partner_FQDN> --replication-partner-admin Administrator --dest-domain-name <destination_local_sso_domain>

Additional Information

Failed to Repoint a vCenter Server Node to an Existing Domain with a Replication Partner | Could not connect to VMware Directory Service via LDAP