vSphere Replication shows error 'No Connection to VR Server: Unknown' after certificate update.

Products

VMware Live Recovery

Issue/Introduction

Following a SSL certificate update on a vSphere Replication Management Server (VRMS) appliance, you may report No Connection warnings.

Symptoms

Replication status for virtual machines remains in a Not Active (RPO violation) state for VMs replicating to the appliance where the certificate was changed. The reverse replication is working without issues.
The vSphere Replication UI or site pairing displays the error: A replication error occurred at the vSphere Replication Server for replication. Details: 'No connection to VR Server: Unknown'.

Synchronization fails even though network connectivity (ping/telnet) between sites is confirmed.
Source ESXi host vmkernel logs indicate SSL handshake failures when attempting to communicate with the DR appliance under /var/run/log/hbragent.log:

2026-06-19T06:05:29.300Z In(166) hbr-agent-bin[61760845]: [0x00000063b7462700] error: [Proxy [Group: ] -> [[##.##.##.##]:32032]] SSL handshake failed: certificate verify failed (SSL routines)
2026-06-19T06:05:29.300Z In(166) hbr-agent-bin[61760845]: [0x00000063b7462700] error: [Proxy [Group: ] -> [[##.##.##.##]]:32032]] Failed to connect to broker on ##.##.##.##]:32032: certificate verify failed (SSL routines)

2026-06-19T01:52:17.673Z Wa (180)vmkwarning: cpul5 : 17601537) WARNING: Hbr: 788: Failed to receive from 127.0.0.1 (groupID=GID-########-####-####-####-#############) : Broken pipe
2026-06-19T01:52:17.673Z Wa (180)vmkwarning: cpul5 : 17601537) WARNING: Hbr: 2389: Failed to receive handshake response

The target VR appliance indicate similar SSL handshake failure events under hbrsrv.log:

2026-06-15T16:55:54.667+08:00 info hbrsrv[01646] [Originator@6876 sub=Main] [0] Exception Vmacore::Exception: Cannot perform SSL handshake for <TCP 'TargetVR_IP : 32032'> -> <TCP 'SourceHost_IP : 56468'> (encrypted): tlsv1 alert unknown ca (SSL routines)

Environment

vSphere Replication 9.0.2

Cause

The issue occurs because the vSphere Replication database (vrmsdb) may retain stale certificate thumbprints from the previous certificate post renewal on one or both appliances.
This mismatch causes SSL handshake failures when the VRMS attempts to communicate with ESXi hosts or the remote site, as the thumbprints stored in the hbrserverentity and hbrserverinfoentity tables do not match the new certificate installed on the appliance.
The correct renewed certificate can be viewed using the below command:

openssl s_client -connect VRappliance_IP/FQDN:8043 2>/dev/null | openssl x509 -noout -fingerprint -sha256

The same can be checked on the browser under 'view site information' in the URL. That will have the certificate details for the appliance:

However, queries to the vrmsdb database (hbrserverentity and hbrserverinfoentity tables) showed a stale thumbprint (8A:7F:B0:14...) and an outdated certificate string.

-[ RECORD 3 ]--------------+------------------------------------------------------------------------------------------------
uuid | 5221a870-####-####-####-############
aggregateversion | 7
configurationurl | https://VRappliance_name:5480/
connected | t
connstatusupdaterequested | f
name | hostname
repltrafficaddress | ##:##:##:##
repltrafficport |
resolvedrepltrafficaddress | ##:##:##:##
sitename | Site_name
thumbprint | 8A:7F:B0:14:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:10:75:E9:CC
tunnelid |
uri | https://127.0.0.1:8123
certificate | -----BEGIN CERTIFICATE----- +
| MIIFU##########################################################################################

Resolution

To resolve this issue, the certificate thumbprints must be manually updated in the VRMS database. Kindly proceed to open a Broadcom Support ticket to fix the issue.