VCF 9.1 Installer fails to connect to the software depot with certificate related errors

Products

• VMware vCenter Server

Issue/Introduction

• During greenfield deployment of a VCF 9.1.0 environment the Installer is unable to connect to the software depot.
• Error seen in the Installer UI:

org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)

certificate_unknown(46)

Unable to construct a valid chain

No issuer certificate for certificate in certification path found.

• The /var/log/vmware/vcf/domainmanger.log on the VCF Installer indicates 403 Forbidden entries:

####-##-##T14:11:05.103+0000 DEBUG [vcf_om,6a15a9f9664e4400bd78164f8937a2ae,d7c2] [c.v.vcf.secure.http.ProxyValidator,http-nio-127.0.0.1-7300-exec-10] Test connection to https://dl.broadcom.com using proxy at <proxy_FQDN>:
8080. Proxy returned HTTP Status: 403 Forbidden. HTTP Headers: Date: Tue, day_month_year 14:11:05 GMT ; Content-Type: text/plain;charset=UTF-8 ; Content-Length: 22 ; Connection: keep-alive ; Strict-Transport-Security: max-age=31536000; incl
udeSubDomains ; Server-Timing: cfEdge;dur=5,cfOrigin;dur=0,cfWorker;dur=0 ; Server: cloudflare ; CF-RAY: a01d5df4db093dba-ZRH

 

Environment

VCF 9.1.0

Cause

• This issue is caused by a Corporate TLS-intercepting proxy, which resigns the certificate presented by dl.broadcom.com. The issuer is not trusted by the VCF Installer.
• To confirm SSL interception run the following:

 

openssl s_client -connect eapi.broadcom.com:443 -proxy <proxy_FQDN>:<proxy_port> -showcerts 2>/dev/null | openssl x509 -noout -text

 

• From the output, check the 'Issuer' field:

 

 

Certificate:

 

    Data:

 

        Version: 3 (0x2)

 

        Serial Number:

 

            4b:48:97:aa:72:ea:69:eb:a2:d0:8b:c0:95:0e:21:de

 

        Signature Algorithm: sha256WithRSAEncryption

 

        Issuer: C = CH, O = <Corporate_CA_Issuer>, CN = <Corporate_CA_>

 

        Validity

 

.............

 

 

• Currently the certificate presented by dl.broadcom.com is "O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1"
• So we can see that the proxy is intercepting the certificate and re-issuing it using 'C = CH, O = <Corporate_CA_Issuer>, CN = <Corporate_CA_>' as the issuer.

Resolution

• Add the corporate issuer certificate (and any intermediates certificates) to the Installer truststores using KB 432021