OVF Deployment Wizard in vSphere Client does not properly handle case sensitivity.

Products

• VMware vCenter Server

Issue/Introduction

• The OVF deployment wizard in vSphere Client does not properly recognize "localhost" source URLs when they're not completely in minor case characters
• This wizard can be opened using either of the following options:
  • Using the "Deploy OVF Template" option available via context- or action menus
  • Select either "NSX", "VMware Aria Operations Configuration" or "Skyline Health Diagnostics" from the drop down menu
• If a local URL is provided with a non-existing target, such as https://localhost/test.ovf", the wizard will immediately recognize it and block the user from continuing:
• However, when the URL contains at least one upper case character, such as https://localhosT/test.ovf, it will present the user with a to SSL thumbprint verification popup:

• This enables the user to move on until the wizard actually tries to verify the configuration of the template on the page "3 - Select a compute resource", at which point an "Unable to process the template" error is thrown as expected:

• This works even if the user does not have permissions to deploy templates

Environment

• VMware vCenter Server 8.0.x
• VMware vCenter 9.x

Cause

When dealing with OVF- or other templates, vSphere Client utilizes the Content Library component in vCenter.
However, the library used by the Content Library to verify URLs is currently handling input in a case sensitive manner.
It does recognize that localhost is mapped to the local loopback interface, making it invalid as OVF source, but fails to recognize the same for localhosT.

Resolution

Currently there is no resolution. VMware engineering is however aware of this issue and working on making a fix available in upcoming vCenter versions.
Subscribe to this article to be informed when this fix has been released.

Additional Information

The fingerprint presented to the potential non-privileged user is the one of the machine SSL certificate, which exposed via the vCenter welcome page https://<vcenter_fqdn>:443 already, it does not exposed additional information.