Error: LCMVRNICONFIG9019 when replacing VCF Operations for Networks certificate in VCF Operations

Products

• VCF Operations
• VCF Operations for Networks

Issue/Introduction

When attempting to replace a VMware Aria Operations for Networks certificate within VCF Operations, the task fails with a certificate error. This occurs typically when the Certificate Signing Request (CSR) was generated outside of the VCF Operations environment.

Symptoms

• VCF Network Certificate Replacement Failure occurs.
• Error LCMVRNICONFIG9019 is displayed in the user interface.
• The following errors appear in /var/log/vrlcm/vmware_vrlcm.log: 
  

  INFO vrlcm [pool-3-thread-91] [c.v.v.l.p.c.v.d.h.VRNIUtils]  -- Calling update certificate API - path /api/ni/settings/certificates
  
  ... "private_key":null}
  
  INFO vrlcm [pool-3-thread-91] [c.v.v.l.p.c.v.d.h.VRNIUtils]  -- Response code - 400 and data - {"code":400,"message":"Bad Request","details":[{"code":400,"message":"Either private key or certificate is missing in the request.","target":[]}]}
  
  ERROR vrlcm [pool-3-thread-91] [c.v.v.l.p.c.v.d.h.VRNIUtils]  -- Failed to update certificate
  
  INFO vrlcm [pool-3-thread-91] [c.v.v.l.p.a.s.Task]  -- Injecting task failure event. Error Code : 'LCMVRNICONFIG9019', Retry : 'true', Causing Properties : '{ CAUSE ::  }'
  
  com.vmware.vrealize.lcm.plugin.core.vrni.common.exception.VRNIPlatformException: Failed to update certificate. Try again

Environment

• VCF Operations 9.0.x
• VCF Operations for Networks 6.x

 

Cause

VCF Operations cannot find the private key associated with the certificate. If the CSR is generated externally, the private key is not stored in the local VCF Operations database, causing the API call to fail.

Resolution

To resolve this issue, generate the CSR directly from within VCF Operations to ensure the private key is correctly stored.

1. Log in to the VCF Operations interface.
2. From the navigation bar at the top, click 

   Manage

   .
3. In the left pane, navigate to 

   Fleet management

   Certificates

   .
4.  
   Follow the steps to generate a new CSR: Generate Certificate Signing Requests in VMware Cloud Foundation.
5. Once the CSR is signed by your CA, complete the certificate replacement process.