Configuring vCenter Group Linking on VCF Operations UI fails with error "Unable to connect to the vCenter instance due to certificate validation error"

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• On VCF Operations 9.1 UI, under Operate -> Configurations -> Logical Groupings -> vCenter Linking, creating a vCenter Group fails with the following error:
  
"Unable to connect to the vCenter instance due to certificate validation error".
  
  Note: For VCF Operations version 9.0, the path to configure vCenter Group Linking is Infrastructure Operations -> Configurations -> Logical Groupings -> vCenter Linking.
  
  
• The /storage/log/vcops/log/adapters/VMwareAdapter/VMwareAdapter_(Internal_id).log in VCF Operations log the following error messages:
  
  ERROR: VALIDATE failed for the Vcenter Id: ######-####-#####-###### with reason: CONNECTION_REFUSED
ERROR: TRUST_ESTABLISHMENT failed for the Vcenter Id:######-####-#####-###### with reason: NO_AVAILABLE_PEERS

Environment

VMware Cloud Foundation 9.x

Cause

The issue occurs when the vCenter certificate is updated out of band and the trusted root store is not updated with the new signing certificates.

Resolution

To establish a secure trust relationship and successfully link the vCenter instances, perform the following steps:

1. Obtain the full chain of certificates (Root CA and Subordinate Root CA) in .pem format from the vCenter. Refer Export the vCenter certificates in .pem format to import

2. Import both the Root CA and the Subordinate CA certificates into the trusted certificate store:

   1. 1. Log in to VCF Operations UI.

      2. For 9.0, navigate to Administration -> Control Panel -> Trusted Certificates -> Import.
         For 9.1, navigate to Operate -> Administration -> Control Panel -> Trusted Certificates -> Import.

      3. Upload the exported certificate.

      4. Review the certificate details and Import. 

3. For VCF 9.0, under Infrastructure Operations -> Configurations -> Logical Groupings -> vCenter Linking, select the vCenter group and click on 'Reset Linking'.
   For VCF 9.1, under Operate -> Configurations -> Logical Groupings -> vCenter Linking, select the vCenter group and click on 'Reset Linking'.

Additional Information

Once the CA chain is imported, the VCF Operations trust store will recognize the certificates issued by the internal PKI. This allows the TLS handshake to succeed, resolving the validation error and allowing the vCenter Linking status to transition to Active.