Error: Failed to generate access key during log collection after 9.1 upgrade

Products

• VCF Operations

Issue/Introduction

After upgrading to VCF Operations 9.1, navigating to Administration > Configurations > Log Collection shows that the VCF Operations component is in a 'Failed' state.

The following error message is displayed in the user interface:

Failed to generate access key. The collector attempts to configure log collector every 5 minutes.

Environment

VCF Operations 9.1

Cause

This issue occurs because the Certificate Subject Alternative Name (SAN) does not include the IP Address of the VCF Operations nodes, leading to an SSLPeerUnverifiedException during verification.

The following log exceptions are observed within the \log-processor-0\vcf-ops-logs\console-log-#######.log.gz file:

2026-06-05T16:43:17.569549444Z  com.vmware.log.common.logcollection.config.exception.AuthTokenGenerationException: Failed to generate access key
2026-06-05T16:43:17.56955129Z   at com.vmware.log.common.logcollection.config.util.LogConfigAuthUtil.generateAccessKeyRawResponse(LogConfigAuthUtil.java:165) ~[log-collection-config-commons-1.0.0.jar!/:?]

2026-06-05T16:43:17.569571367Z  Caused by: java.util.concurrent.ExecutionException: javax.net.ssl.SSLPeerUnverifiedException: Host name '<VCF-Ops-IP>' does not match the certificate subject provided by the peer

Resolution

Regenerate the Certificate Signing Request (CSR) to include the required IP addresses and replace the certificate by following these steps:

1. Log in to the VCF Operations UI.
2. Click on the 'Manage' tab, then navigate to Fleet Management > Certificates.
3. Select the VCF Operations component, click the three dots (...) option, and select Generate CSR.
4. Ensure that the IP addresses for all VCF Operations nodes, along with the Virtual IP (VIP) address, are included in the Subject Alternative Name (SAN) section.
5. Have the generated CSR signed by your external Certificate Authority (CA).
6. Once the certificate is issued, return to the VCF Operations UI and import the newly signed certificate.
7. Replace the certificate for the VCF Operations component.

Once completed, navigate to Administration > Configurations > Log Collection and verify that the VCF Operations component now displays a 'Configured' status.