Missing intermediate certificates in VCF Automation after replacing with imported certificates via Operations UI

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When you replace certificates for VCF Automation (VCFA) using the "Replace with imported certificates" operation in the Ops UI, the operation shows as successful. However, when viewing the imported certificates in the Ops UI, the new leaf certificates are present, but the certificate with the category "Intermediate" is missing.

Environment

VCF Automation 9.1.0

Cause

When the "Replace with imported certificates" operation is triggered in the Ops UI, an internal process fetches the full certificate chain to build the payload for VCF Automation. During this process, the payload incorrectly assigns only the leaf certificate to the "cert" component and only the root certificate to the "ca" component, effectively stripping away any intermediate certificates.

This issue is specific to the VCF Automation certificate update path and does not impact other VCF Service Runtime (VMSP) components.

Resolution

This issue is resolved in VMware Cloud Foundation Automation 9.1.1 and higher.

Prerequisites

• You have already obtained a signed certificate from your Certificate Authority (CA) that includes the full chain.
• You have the intermediate certificate(s) and root CA concatenated in PEM format.

Workaround: If you are running a version prior to 9.1.1, you can work around this issue by modifying the secret directly with the existing certificate.

1. SSH to the VCF Automation appliance and switch to the root user:

   sudo su -

2. Export the KUBECONFIG environment variable to interact with the Kubernetes cluster:

   export KUBECONFIG=/etc/kubernetes/admin.conf

3. Update the ingress-vcfa-tls-external secret to have the full cert chain:

   kubectl -n prelude patch secret ingress-vcfa-tls-external --type merge --patch "{\"data\":{\"tls.crt\":\"$(base64 < fullchain.pem | tr -d '\n')\"}}"