SSL Certificate Replacement Failure for VCF Identity Broker 9.0.2 - "Missing values for certain mandatory..."

Products

• VCF Operations

Issue/Introduction

When attempting to replace the SSL certificate for the VCF Identity Broker (VIDB) 9.0.2 appliance using an external CA-signed certificate, the process fails with the following error:

Certificate replacement for appliance <vidb-mgmt-#####> has failed. Failed to perform the specified operation. Missing values for certain mandatory properties. Provide the required properties and retry.

Additionally, you may observe the following:

• The Self-Signed CA certificate for the VIDB appliance IP/FQDN is removed and no longer displayed in the Fleet Management > Certificates > VCF Management page.
• The replacement process terminated prematurely, leaving the appliance without a valid certificate assigned in the UI.

Environment

• VCF Operations 9.0.2

• VCF Identity Broker 9.0.2

Cause

This issue typically occurs if the required certificate workflow steps are bypassed or if the certificate bundle is incomplete. Specifically:

1. The Certificate Signing Request (CSR) must be generated from the VIDB appliance context to ensure all mandatory properties and metadata are captured.
2. The imported PEM file did not include the full certificate chain (Leaf, Intermediate, and Root certificates). VCF 9.0.x performs strict validation and requires the complete chain to establish trust and maintain inventory synchronization.

Resolution

To resolve this issue, you must regenerate the certificate using the proper CSR workflow and ensure the full chain is included in the PEM file.

Step 1: Generate a New CSR

1. Navigate to Fleet Management > Certificates.
2. Select the VCF Identity Broker appliance component that has the TLS Certificate category, click the 3 dots at the top and choose the option to Generate CSR.
3. Provide the required properties (Common Name, Organization, SAN entries, etc.). Ensure the FQDN and IP of the VIDB appliance are included.
4. Download the generated CSR.

Step 2: Sign, Prepare and Import the Certificate with Full Chain

1. Submit the CSR to your External Certificate Authority (e.g., DigiCert) for signing.
2. Download the signed certificate along with the full certificate chain (Intermediate and Root CA certificates).
3. Combine the certificates into a single PEM file in the following order

   -----BEGIN CERTIFICATE----- (Leaf/Service Certificate)
   
   -----END CERTIFICATE-----
   
   -----BEGIN CERTIFICATE----- (Intermediate CA Certificate)
   
   -----END CERTIFICATE-----
   
   -----BEGIN CERTIFICATE----- (Root CA Certificate)
   
   -----END CERTIFICATE-----
   

4. Import the certificate to Fleet Management > Certificates by clicking the 3 dots and choosing Import Certificate

Step 3: Replace the Certificate

1. In the VCF Operations portal, navigate to Fleet Management > Certificates > VCF Management.
2. Select the VCF Identity Broker appliance component
3. Use the Replace with Imported Certificates option.
4. Select the newly imported certificate from the drop-down menu and click Replace
5. Once the replacement task completes successfully, trigger an inventory sync of the VIDB appliance to ensure the certificate is correctly reflected in the inventory.
6. Validate the certificate and thumbprint in the Fleet Management > Lifecycle > VCF Management > Components page.

Additional Information

Install Third-Party CA-Signed Certificates (Broadcom TechDocs)

Use the vropsCertificateTool.py script from Using the Custom Certificate Tool in VMware Aria Operations to analyze the certificate PEM file. This tool helps identify mismatches or missing links in the intermediate issuer chain.