VCF Operations Connection to NSX Manager Fails with message "Failed to establish connection to NSX Manager due to an incorrect username or password"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In VCF Operations, the integration to NSX displays the following warning: "Failed to establish connection to NSX Manager due to an incorrect username or password."

Attempting to remediate the issue by rotating the system-managed credential fails. The VCF Operations integrations page continues to show an error connecting to NSX Manager and vCenter Server.

The operationsmanager.log on SDDC Manager does not show entries for the rotation (e.g., c.v.v.s.s.ServiceAccountService), suggesting the task is not reaching the SDDC Manager.

The /storage/log/vcops/log/collector.log on cloud proxy shows the following errors during account creation:

Caused by: com.vmware.adapter3.diagnostics.http.exception.UntrustedCertificateException: Certificate thumbprint for host[sddcManagerFQDN] does not match what is expected. The server certificate thumbprint doesn't
match any of the expected list. Expected: '[abcd####1234, efgh####5678, ijkl####9101]'. Actual: 'lmno####1213'
        at com.vmware.adapter3.diagnostics.http.client.HttpClient.parseException(HttpClient.java:462) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.http.client.HttpClient.sendRequest(HttpClient.java:277) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.http.client.HttpClient.sendRequest(HttpClient.java:196) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.http.client.HttpClient.sendRequest(HttpClient.java:206) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.http.client.HttpClient$RequestBuilder.send(HttpClient.java:935) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.http.client.HttpClient$RequestBuilder.send(HttpClient.java:945) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.http.client.HttpClient$RequestBuilder.sendRequest(HttpClient.java:903) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.collector.common.product.connector.ProductAuthenticator.createSession(ProductAuthenticator.java:97) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.collector.common.product.connector.ProductAuthenticator.readFromCache(ProductAuthenticator.java:71) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.collector.common.product.connector.ProductAuthenticator.authenticate(ProductAuthenticator.java:45) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.collector.common.product.connector.ProductAuthenticator.authenticate(ProductAuthenticator.java:39) ~[DiagnosticsAdapter3.jar:?]
        at com.vmware.adapter3.diagnostics.collector.core.tasks.RestfulCollectionTask.addCustomContextEntries(RestfulCollectionTask.java:54) ~[DiagnosticsAdapter3.jar:?]
        ... 11 more
Caused by: com.vmware.adapter3.diagnostics.http.exception.ThumbprintMismatchException: The server certificate thumbprint doesn't match any of the expected list. Expected: '[abcd####1234, efgh####5678, ijkl####9101]'. Actual: 'lmno####1213'
...

YYY-MM-DDTHH:MM:SS ERROR collector 1088155 [ops@4413 threadId="6013337" threadName="TasksManager-TaskHandler-79342"] [com.vmware.vrops.adapter.vcf.util.VcfAdapterRestClient.error] - SSLHandshakeExceptions occurred during retryPKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
YYY-MM-DDTHH:MM:SS WARN  collector 1088155 [ops@4413 threadId="6013337" threadName="TasksManager-TaskHandler-79342"] [com.vmware.vrops.adapter.vcf.auth.AuthenticationManager.warn] - Exception occurred while connecting to url https://[sddcManagerFQDN]/v1/tokens
com.vmware.vrops.adapter.vcf.exception.VcfException: SSLHandshakeException occurred during connection to VCF. Please verify the certificates and accept them

Environment

VCF Operations 9.0.1

Cause

The VCF Operations adapter fails to receive the required CA certificates during Service Account creation because certificates imported via the Control Panel are not being propagated to the adapter instance. This results in SSL handshake errors and subsequent task failure.

Resolution

• Upgrade VMware Cloud Foundation to version 9.0.2, where this issue has been resolved.