500 Error integrating Microsoft Certificate Authority with VCF 9.x Certificate Management
Article ID: 445091
Updated On:
Products
Issue/Introduction
- Failure to accept credentials when configuring a Certificate Authority for VMware Cloud Foundation.
- Errors replacing certificates:
Certificate replacement for appliance hostname has failed. 500 : "{"status":"","message":"Invalid request found.","errorCode":"LCM_CERTIFICATE_API_ERROR0000","errorLabel":"Unknown Certificate error.","recommendations":[]}"
Environment
VCF Operations 9.x
Cause
Incorrect Microsoft Certificate Authority configuration for template, permissions or service account.
If you plan to configure a Microsoft Certificate Authority for use with VMware Cloud Foundation, there are some steps you must perform before you can do so.
Resolution
- Install Microsoft Certificate Authority Roles
- Configure the Microsoft Certificate Authority for Basic Authentication
- Create and Add a Microsoft Certificate Authority Template
- Assign Certificate Management Privileges to the VMware Cloud Foundation Service Account
Note,
Use curl to test basic the service account basic authentication from VCF Ops.
root@opslcm-a [ / ]# curl -ik --basic -u "domain\svc-vcf-ca" https://ca_fqdn/certsrv/
Enter host password for user 'domain\svc-vcf-ca':
HTTP/1.1 200 OK
Before you can replace a certificate with a CA-configured certificate or activate auto-renewal for Microsoft Certificate Authority or OpenSSL certificates, you must configure a Certificate Authority (CA).
- Configure a Certificate Authority for VMware Cloud Foundation
- Log in to the VCF Operations console at https://<vcf_operations_fqdn> with a user assigned the Administrator role.
- Click Fleet ManagementCertificates.
- Click VCF Management or click VCF Instances and click a VCF Instance name.
- You configure the Certificate Authority for VCF management components separately from the Certificate Authority for VCF Instance components. If you have more than one VCF
- Instance, you configure the Certificate Authority for each one separately.
- Click Configure CA.
- Enter the details for your Certificate Authority and click Save.
Check logs on the fleet manager for errors:
root@opslcm-a [ / ]# cat /var/log/vrlcm/vmware_vrlcm.log | grep -i error
Additional Information
Feedback
