Error: [500] An error occurred while fetching identity providers due to expired LDAP certificates in vCenter Server due to a single expired LDAP certificate

Products

• VMware vCenter Server

Issue/Introduction

• A banner displays "[500] An error occurred while fetching identity providers" in the vSphere Client.
• A banner may display, "Identity Source LDAP Certificate is about to expire."

•  AD logins may fail intermittently.
• The Identity source is set up with an LDAPS solution using a single target that routes to several domain controllers.
  
  Example: ldaps://ldap.domain.com:636
  
  
• /opt/vmware/bin/sso-config.sh -get_identity_sources command shows one or more expired certificates.
  
  
  
• The vCert tool also shows one or more expired certificates:
  
  

 

Environment

vSphere 8.0.3

Cause

This issue occurs when the vCenter Server Single Sign-On (SSO) service encounters an expired LDAP certificate. Specifically, if an LDAP identity source was added and one of the underlying certificates has since expired, the "fetch identity providers" call fails during the authentication handshake if the domain controller that is contacted has an expired certificate.

Resolution

1. Shutdown and take snapshots of all vCenter Server nodes within the SSO domain.
2. Log in to the vCenter Server Appliance (VCSA) via SSH as root.
3. Download the vCert utility. Refer to vCert - Scripted vCenter expired certificate replacement (KB 385107).
4. Run the vCert utility: python vCert.py
5. Select Option 3 (Manage Certificates).
6. Select Option 11 (Remove expired/stale LDAP certificate).
7. Identify and remove the expired certificate corresponding to the date ####.
8. Restart all vCenter services to clear the cached error: service-control --stop --all && service-control --start --all
9. Refresh the vSphere Client to confirm the error is resolved.

Additional Information

If there are linked vCenters that are using the same Identity Source. The resolution may have to be performed on each linked vCenter.