Error: "Not able to initiate ApiClient for endpoint" when configuring SSO

Products

• VCF Operations

Issue/Introduction

• When configuring SSO on VMware Cloud Foundation (VCF) Operations you receive the error below:
  
  Not able to initiate ApiClient for endpoint ##.##.##.##


• In /storage/vcops/log/adapters/ManagementAdapter/ManagementAdapter_##.log on VCF Operations appliance you see the log enty below:

  DATE TIME ERROR ManagementAdapter 7720 [ops@4413 threadId="2846954" threadName="TasksManager-TaskHandler-71929" instanceId="57"] [(57) com.vmware.adapter.management.components.iam.client.ApiClientProvider.getApiClient] - Failed to generate ApiClient
java.lang.RuntimeException: Failed to execute request POST https://##.##.##.##/api/session with exception Host name '##.##.##.##' does not match the certificate subject provided by the peer (CN=VCENTER FQDN, OU=###, O=###, L=####, ST=####, C=##)
[...]
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Host name '##.##.##.##' does not match the certificate subject provided by the peer (CN=VCENTER FQDN, OU=###, O=###, L=####, ST=####, C=##)
[...]
DATE TIME ERROR ManagementAdapter 7720 [ops@4413 threadId="2846954" threadName="TasksManager-TaskHandler-71929" instanceId="57"] [(57) com.vmware.adapter.management.components.iam.task.idp.configurator.LdapBindConfigurator.createIdpInternal] - Not able to initiate ApiCli
ent for endpoint ##.##.##.##

Environment

VMware Cloud Foundation 9.0

Cause

The VCF Operations client is attempting an API session bound to vCenter IP address, while the target vCenter certificate exclusively authorizes the Fully Qualified Domain Name (FQDN). 

Resolution

1. Reconfigure vCenter integration within the VCF Operations UI to use the vCenter FQDN instead of the IP address.
2. If the vCenter integration has been already configured using the FQDN, test the connectivity and accept again the vCenter certificate.
3. Ensure that the VCF Operations appliance can correctly resolve vCenter FQDN via its configured DNS servers.
4. If IP-based routing is strictly required by the environmental network topology, the target vCenter machine SSL certificate must be regenerated to explicitly include the IP address within the Subject Alternative Name (SAN) extension.