VCF Installer fails to add hosts with error: "Error occurred while getting certificate chain"

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

• During the host addition or validation phase in the VMware Cloud Foundation (VCF) Installer, the process fails during the SSL handshake with the ESXi hosts. The UI report the following error: "Error occurred while getting certificate chain for <ESXi-FQDN>"
  
  
• The user may have already attempted to regenerate certificates on the ESXi hosts or reboot the appliances, but the error persists despite the hosts appearing healthy and manageable individually.

Environment

• VMware Cloud Foundation (VCF)
• VCF Installer Appliance

Cause

The VCF Installer appliance is unable to resolve the Fully Qualified Domain Names (FQDNs) of the ESXi hosts it is attempting to add.

While the ESXi hosts themselves may have correct DNS settings, the VCF Installer appliance often has an empty or misconfigured /etc/resolv.conf file. Because the installer initiates the certificate fetch using the FQDN on port 443, the lack of a valid DNS resolver prevents the appliance from locating the host to retrieve its certificate chain, resulting in a validation failure.

Resolution

To resolve this issue, manually configure the DNS servers on the VCF Installer appliance.

Follow the below steps:

1. SSH into the VCF Installer appliance using the vcf user and su to root.
2. Test name resolution by running a nslookup against the ESXi FQDN:

   nslookup <ESXi-FQDN>

   
   If it returns "Temporary failure in name resolution," the DNS is not configured.
   
   
3. Inspect the current DNS configuration:

   cat /etc/resolv.conf

4. Update DNS Servers: If using VCF 9.x or Photon-based appliances, use the management command:

   nmctl set-dns dev <DEVICE> dns <DNS-IP-1>,<DNS-IP-2>

   Note: Ensure no spaces after commas.

5. Ensure the appliance can now resolve the hostnames:

   nslookup <ESXi-FQDN>

6. Return to the VCF Installer browser interface and retry the host validation/addition step.