Error: "Disconnected" when opening VM consoles

Products

• VMware Cloud Director

Issue/Introduction

• Web Consoles in VMware Cloud Director (VCD) are not working after vCenter certificate has been updated.
• In the /opt/vmware/vcloud-director/logs/console-proxy.log we could see the following entries:
  
  PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Environment

VMware Cloud Director 10.6.1

Cause

VCD requires explicit trust of the vCenter Server certificate for the web consoles to work. When a vCenter certificate is replaced or renewed, the existing trust relationship between VCD and vCenter is invalidated, causing component failures, including web console connectivity.

Resolution

We have two options to trust the vCenter Certificate

1. Automated :
   Run this cell-management-tool command from any VCD cell to retrieve and trust certificates from all configured vCenter Server and NSX servers as well as the VMCA certificate: 
   
   /opt/vmware/vcloud-director/bin/cell-management-tool trust-infra-certs --vsphere --unattended 
   
   This command helps by providing additional options on how to review the certificates that will be trusted before trusting them.
   
   
2. Manual:
   Should the above options not be possible, the VMCA certificate can be downloaded manually and uploaded to the Cloud Director Trust store. 
   
   To manually download the vCenter Server Root Certificates please refer to the following KB .
   To import the VMCA certificate follow the Cloud Director Import Trusted Certificates documentation.