Aria Automation fails to add VCF Cloud Account with Invalid Certificate error

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When attempting to add a new VMware Cloud Foundation (VCF) Cloud Account in VMware Aria Automation, or when validating the SDDC Manager integration under System Settings > Integrations, the configuration fails. The system displays the following error message in the user interface:

Invalid certificate in the requested target Error Id "UUID"

Additionally, under the SDDC Manager integration page, workload domains fail to populate.

The following symptoms are observed within the log files:

In the provisioning-service-app.log

YYYY-MM-DDT00:00:00.524Z INFO provisioning [host='######' thread='reactor-http-epoll-10' user='' org='' trace='' parent='' span=''] c.vmware.xenon.common.SpringHostUtils.responseEntityToOperation:971 - [GET http://######:8090/content/api/vcf/5c48d99b-573c-d974-1586-############/domains?page=0&size=20] JSON error response, status code: 400, body: [{"message":"Invalid certificate in the requested target","statusCode":400,"errorCode":25037,"details":[]}]
2026-06-01T09:37:41.525Z WARN provisioning [host='######' thread='reactor-http-epoll-10' user='' org='' trace='' parent='' span=''] c.v.xenon.common.ServiceErrorResponse.create:85 - message: Invalid certificate in the requested target, statusCode: 400, serverErrorId: 3b27c99r-941b-c591-1586-############: Caused by java.lang.RuntimeException: Invalid certificate in the requested target
                at com.vmware.xenon.common.SpringHostUtils.responseEntityToOperation(SpringHostUtils.java:974)

In the cgs-service-app.log

2026-06-01T10:19:15,924Z ERROR cgs-service [host='######' thread='http-nio-8090-exec-6' user='provisioning-secret(configadmin)' org='5c48d99b-573c-d974-1586-############' trace='secret']  com.vmware.cgs.content.configuration.GlobalExceptionHandler - Api retuned status 400. Resource Access Exception: org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://######/v1/tokens": PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Environment

VMware Aria Automation 8.18.1

Cause

The certificate saved within the Aria Automation SDDC Manager integration mapping does not match the current Machine SSL certificate active on the target SDDC Manager instance. This mismatch causes the internal cgs-service connection to fail with a SunCertPathBuilderException during token exchange operations.

Resolution

To resolve this issue, update the trusted certificate inside the Aria Automation integration configuration using the IaaS API engine. You can use the Swagger UI to do this.

Retrieve the list of all configured integrations to locate the specific entry ID for the target SDDC Manager by sending a GET request:
```
GET /iaas/api/integrations
```
Locate the SDDC Manager block inside the JSON output response and copy its specific integration id.
Connect to the SDDC Manager command-line interface or access the endpoint externally to pull the active Machine SSL certificate payload using openssl:
```
openssl s_client -connect <SDDC_Manager_FQDN>:443 -showcerts
```
Copy the primary certificate block (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers).
Update the integration details by executing a PATCH request against the target integration resource path. Sanitize your escape characters (\n) within the certificate string data payload:
```
PATCH /iaas/api/integrations/{id}
```
```
{
  "certificateInfo": {
    "certificate": "-----BEGIN CERTIFICATE-----\n....\n-----END CERTIFICATE-----"
  }
}
```
Retry configuring the VCF Cloud Account structure inside the VMware Aria Automation cloud template console.

Additional Information

For more information regarding API endpoint usage and IaaS mapping rules, refer to the Broadcom Developer Portal.