Import VCF Operations in Fleet Lifecycle task fails during VCF 9.1 upgrade

Products

• VCF Operations for Networks
• VCF Operations

Issue/Introduction

• VCF Upgrade from 9.0.2 to 9.1 failed at Import VCF Operations in Fleet Lifecycle
• The "Import VCF Operations in Fleet Lifecycle" task fails during a VCF 9.1 upgrade. This failure typically occurs at the discover_vrni_component_task_ref step.
  
  An unexpected error occurred in step discover_vrni_component_task_ref. Reference Code: 6F30FB09 Detail: I/O error on POST request for "https://####:443/api/auth/login": Certificate for <####> doesn't match any of the subject alternative names: []
  
  Additional Reference Codes: 0119F0D1, 10BD71C4, 43C6E812.
  
• • SDDC Manager logs display the following error: Detail: I/O error on POST request for "https://####:443/api/auth/login": Certificate for <####> doesn't match any of the subject alternative names: []

Environment

• VCF Operations 9.1.0.0
• VCF Operations for Networks 9.0.x

 

Cause

VCF 9.1 enforces strict Subject Alternative Name (SAN) validation for TLS connections. The VCF Operations for Networks platform node certificate is missing the appliance IP address in the SAN field or the IP address is incorrectly categorized as a DNS entry.

Resolution

Fixed in future versions of VCF 9.1.x 

1. Log in to the VCF Operations for Networks platform node.
   
   
2. Run the following command to verify the current SAN entries: openssl s_client -connect localhost:443 | openssl x509 -text -noout | grep -A 1 "Subject Alternative Name"
   
   
3. If the IP address is missing or listed as a DNS: entry, regenerate the certificate.
   
   
4. Ensure the new certificate includes the FQDN as a DNS entry and the IP address as an IP Address entry in the SAN field.
   
   
5. Apply the new certificate and resume the "Component import" task in SDDC Manager.
   
   For detailed scripted cleanup and import steps, refer to  KB 440459
   
   
   
   
   
   

Additional Information

Subscribe to this article to receive updates on fix status, Refer to steps on KB 275360 on how to subscribe this KB