Error: PKIX path building failed during vSphere Replication health check

Products

• VMware Site Recovery Manager

Issue/Introduction

When performing Enhanced Replication Mappings or health checks between sites, the following error occurs:

• Fault occurred while performing health check. 
  
  'PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target'.

This issue typically arises after a host upgrade or host certificate renewal.

Environment

• VMware vSphere Replication 8.x
• VMware vSphere Replication 9.x
• VMware Cloud Foundation (VCF)

Cause

The internal Host Management Service Database (VRDB) tables are not updated with the host's new SSL thumbprint because the configuration file /opt/vmware/hms/conf/hms-configuration.xml contains an invalid value.

Specifically, a parameter expected to be a Boolean (true/false) is set to a string value such as offline. This prevents the Host Management Service (HMS) from signaling a reconnection using the new certificate.

Resolution

1. Log in to the vSphere Replication appliance via SSH
2. Back up the current configuration: cp /opt/vmware/hms/conf/hms-configuration.xml /opt/vmware/hms/conf/hms-configuration.xml.bak
3. Open the file for editing: vi /opt/vmware/hms/conf/hms-configuration.xml
4. Locate the parameter containing the invalid value. (e.g., <hms-auto-install-hbragent-vib>offline</hms-auto-install-hbragent-vib>).
5. Change the invalid value to true or false as appropriate for the environment.
6. Save and exit the editor.
7. Restart the HMS service: systemctl restart hms
8. Reconnect the impacted ESXi host in vCenter using root credentials to update the thumbprint.