LDAP synchronization fails with the error "Sync Failed"

Products

• VCF Operations

Issue/Introduction

• Domain authentication remains functional but manual or scheduled directory syncs do not complete.
• VIDB sync logs shows error "LDAP server is not reachable. This could be due to network issues, firewall blocks, an incorrect hostname, or invalid BIND credentials. Please verify the configuration and retry the sync."

Environment

• VCF Operations 9.0.x
• VIDB 9.0.x

Resolution

1. From a VCF node, run the following command to retrieve the current certificate chain from the domain controller: 

   openssl s_client -connect <AD_FQDN>:636 -showcerts

2. Copy the outputted certificates (Root, Intermediate, and Issuing) into a single PEM formatted file.
3. Login to VCF Operations.
4. Navigate to Fleet Management → Identity & Access → Expand VCF Instances
5. Select the Identity source tab, find the relevant provider, and click Edit.
6. Remove the existing certificate under Encrypted Connection 
7. Upload the new PEM file in the Encryption section.
8. Provide the Bind user password and click Save.
9. Select Check/Retry Sync to verify that the synchronization status returns to SUCCESS.