VVOLs are inaccessible after a certificate refresh on the vasa provider server

Products

• VMware vSphere ESXi

Issue/Introduction

 

• VASA Provider status shows as Offline or Disconnected in the vSphere Client for the ESXi hosts.
• Storage volumes (vVols) are inaccessible or disconnected from ESXi hosts.
• ESXi vvold.log, you see entries similar to:

  * Host name does not match the subject name(s) in certificate`  
   VasaSession::Initialize: Failed to establish connection https://<IP_ADDRESS>:9997/vasa`  
   TimedInit: Returning session state: AuthorizationError`  

 

 

 

 

 

Environment

VMware vCenter Server 7.x / 8.x
Third-party Storage Arrays using VASA Providers.
VASA Provider registered using an IP address in URL.

Cause

The VASA Provider certificate contains a Common Name (CN) or Subject Alternative Name (SAN) that matches the FQDN of the storage processor, but the provider was registered in vCenter using an IP address. During the SSL handshake, the host performs a name validation check. If the registered address (IP) does not match the names listed in the certificate (FQDN), the connection is rejected with a hostname mismatch error.

Resolution

To resolve this issue, re-register the VASA Provider using its Fully Qualified Domain Name (FQDN) instead of the IP address.

1.  Ensure a fresh snapshot of the vCenter Server is taken before proceeding.
2.  Navigate to Storage Providers: In the vSphere Client, go to vCenter Server > Configure > Storage Providers.
3.  Remove the Affected Provider: Select the VASA provider currently showing Offline or Disconnected and click Remove.
4.  Add the Provider using FQDN:
    Click Add > In the URLfield, use the FQDN of the VASA provider.
    Provide the appropriate credentials.

5.  Sync Storage Providers: Once added, click Rescan or Synchronize Storage Providers.
6.  Verify Connectivity: Confirm the status returns to Online and perform a storage rescan on the affected ESXi hosts to restore vVol accessibility.

Note: If the issue persists, ensure the ESXi hosts can resolve the FQDN of the VASA provider via DNS.