VDT on vCenter server reports a FAIL status for Identity Source Certificate Checks with a python error

Products

• VMware vCenter Server

Issue/Introduction

• When running the VCF diagnostic tool for vSphere (VDT) on vCenter, the Identity Source Certificate Check fails with a Python traceback similar to:

Identity Source Certificate Checks
            [FAIL]    Identity Source Certificate Check
                        Traceback (most recent call last):
                          File "/root/Tools/vdt-2.3.0_05-04-2026/lib/vdt_formatter.py", line 354, in run_check
                            check_output = self.run(check, self.username, self.password)
                          File "/root/Tools/vdt-2.3.0_05-04-2026/lib/vdt_base.py", line 475, in run
                            return self.safe_execute(item, username, password)
                          File "/root/Tools/vdt-2.3.0_05-04-2026/lib/vdt_base.py", line 445, in safe_execute
                            return self.execute(params, username, password)
                          File "/root/Tools/vdt-2.3.0_05-04-2026/lib/vdt_base.py", line 404, in execute
                            return main_script(username=username, password=password)
                          File "/root/Tools/vdt-2.3.0_05-04-2026/vcenter/vc_scripts/vc_cert_check.py", line 1040, in check_identity_source_certs
                            checks.append({'subheading': id_name, 'checks': verify_id_source_cert(ids.get('certificates'))})
                          File "/root/Tools/vdt-2.3.0_05-04-2026/vcenter/vc_scripts/vc_cert_check.py", line 1024, in verify_id_source_cert
                            p_cert = Cert(cert)
                          File "/root/Tools/vdt-2.3.0_05-04-2026/vcenter/vc_lib/common.py", line 1524, in __init__
                            parsed_cert = parseCert(cert,file)
                          File "/root/Tools/vdt-2.3.0_05-04-2026/vcenter/vc_lib/common.py", line 1348, in __init__
                            self.x509 = load_certificate(FILETYPE_PEM, self.built_cert)
                          File "/usr/lib/python3.10/site-packages/OpenSSL/crypto.py", line 2034, in load_certificate
                            _raise_current_error()
                          File "/usr/lib/python3.10/site-packages/OpenSSL/_util.py", line 57, in exception_from_error_queue
                            raise exception_type(errors)
                        OpenSSL.crypto.Error: [('asn1 encoding routines', '', 'wrong tag'), ('asn1 encoding routines', '', 'nested asn1 error'), ('PEM routines', '', 'ASN1 lib')]

Environment

VDT for vCenter version 2.3.0

Cause

This issue is caused by a limitation in the VDT tool's ability to parse certain identity source certificates. In some configurations, the identity source certificate is stored in a Base64 encoded format that the current version of VDT (2.3.0) cannot decipher. When the tool attempts to load these certificates for validation using the OpenSSL library, it fails with an "ASN1 lib" error because it cannot recognize the encoding tag.

Resolution

This issue will be addressed in a future release of VDT.

Additional Information

Using the VCF Diagnostic Tool for vSphere (VDT)