Error: PKIX path building failed when importing OVF or opening VM consoles in Cloud Director

Products

• VMware Cloud Director
• VMware vCenter Server
• VMware vSphere ESXi
• VMware Telco Cloud Platform

Issue/Introduction

• Importing OVF to VCD fails with "PKIX path building fails with: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
• VM consoles in the Cloud Director Tenant UI appear blank or disconnected.
• In vCenter, ESXi host certificates show a status of "EXPIRING" even when using VMCA.
• Importing manually the esxi's certificate into VCD truststore resolves the issue only for that host
• Attempting to trust vCenter Server certificates using cell-management-tool fails with: [Download: FAILURE].
• The cell-management-tool.log may show payload parsing errors or "Empty input" warnings.

Environment

VCD: 10.6.1

ESXi: 8.0 U3

VC: 8.0 U3

TCP:5

Cause

This issue occurs when ESXi host certificates enter an "EXPIRING" state. This prevents the vCenter Server from providing a valid certificate payload to Cloud Director, causing the trust-infra-certs command and console proxy connections to fail.

Resolution

Option 1: Manual Renewal via vSphere UI

1. Log in to the vSphere Client.
2. Navigate to the affected ESXi host.
3. Right-click the host and select Certificates > Renew.
4. Verify the certificate status returns to "Normal."
5. In Cloud Director, re-run: 
   

   /opt/vmware/vcloud-director/bin/cell-management-tool trust-infra-certs --vsphere --unattended

6. Confirm issue is resolved

Option 2: Use 3rd party tools such as PowerCLI to automate the replacement

Additional Information

Managing vSphere environment with the VMware PowerCLI