An expired Domain Controller certificate causes Aria Operations for Logs connection failures on the vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• Integrated services such as Aria Operations for Logs (formerly Log Insight) or automation tools like Ansible report random connection failures.
  
  This alert is about your VMware Aria Operations for Logs installation on https://loginsight.domain_name/
vCenter auto-configuration failed triggered at YYYY-MM-DDTHH:MM:SS
vCenter task auto-configuration failed for the following host: vCenter_FQDN
{"key":"com.vmware.loginsight.vsphere.config.VimVsphereConfigurer.cannotConnect","params":[]}
  
  
• Reviewing the /var/log/vmware/sso/vmware-identity-sts.log file in vCenter reveals the following error:
  
  YYYY-MM-DDTHH:MM:SS.Z ERROR sts[##:tomcat-http--##] [CorId=########-####-####-####-############] [com.vmware.identity.interop.ldap.OpenLdapClientLibrary]Certificate trust check failed: NotAfter: Day Month DD HH:MM:SS GMT YYYY
YYYY-MM-DDTHH:MM:SS.Z WARN sts[##:tomcat-http--##] [CorId=########-####-####-####-############] [com.vmware.identity.interop.ldap.LdapErrorChecker] Error received by LDAP client: com.vmware.identity.interop.ldap.OpenLdapClientLibrary, error code: -1
YYYY-MM-DDTHH:MM:SS.Z WARN sts[##:tomcat-http--##] [CorId=########-####-####-####-############] [com.vmware.identity.idm.server.ServerUtils] cannot bind connection: [ldaps://domain_name, CN=########,OU=Service Accounts,DC=###,DC=###,DC=#####]
YYYY-MM-DDTHH:MM:SS.Z ERROR sts[##:tomcat-http--##] [CorId=########-####-####-####-############] [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldaps://domain_name] because [com.vmware.identity.interop.ldap.ServerDownLdapException] with reason [Can't contact LDAP server] therefore will try to attempt to use secondary URIs, if applicable
  
  
• Intermittent authentication failures might occur when logging into vCenter Server using Active Directory credentials. However, local SSO accounts (e.g., '[e-mail]') authenticate successfully.

Environment

VMware vCenter Server 8.x
VMware Aria Operations 8.x

Cause

One or more Domain Controllers (DCs) in the Active Directory identity source pool are serving an expired SSL certificate. Because the identity source uses a load-balanced or generic domain URI (e.g., ldaps://####), authentication fails only when the vCenter LDAP client connects to a domain controller hosting the expired certificate.

Resolution

1. Establish an SSH session to the vCenter Server Appliance.
2. Run the following command for each Domain Controller IP or FQDN associated with the identity source:
   openssl s_client -connect <DC_IP_OR_FQDN>:636 -showcerts | openssl x509 -noout -enddate
3. Locate any domain controller returning 'notAfter=####' (an expired date).
4. Renew the local machine certificate on the specific Windows Domain Controller(s) identified above. For assistance, contact the internal Active Directory team or the guest operating system vendor.
5. Verify the connection again from the vCenter SSH shell to confirm the domain controller presents the updated certificate.

Additional Information

For instructions on configuring LDAPS identity sources, see Single Sign-On Identity Source configuration using LDAPS in vSphere Client.