VCF Operations deployment fails with "localhost" hostname and certificate validation errors during VCF 9.1 installation

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

When deploying VMware Cloud Foundation (VCF) 9.1 in a greenfield environment, the VCF Operations node deployment fails. The following symptoms may be observed:

• The VCF Operations appliance initializes with the hostname localhost instead of the FQDN defined in the deployment specification.
• The deployment process fails during the validation or initialization phase with a timeout.
• The installer.log contains errors similar to:

ValueError: 'vcf-ops-fqdn.example.com' does not appear to be an IPv4 or IPv6 address
javax.net.ssl.SSLPeerUnverifiedException: Certificate for <FQDN> doesn't match any of the subject alternative names: [localhost]

Environment

• VMware Cloud Foundation 9.1
• VMware SDDC Manager
• VCF Operations (formerly vRealize Operations)

Cause

This issue typically occurs when the VCF Operations node cannot appropriately resolve its own FQDN during the initial bootstrap process. Common root causes include:

• Incorrect Host Mapping: The /etc/hosts file on the installer machine or the deployed node incorrectly maps the FQDN to a loopback address (127.0.0.1).
• DNS Configuration: Improperly formatted DNS server entries (e.g., containing trailing spaces) or incorrect VLAN IDs in the deployment JSON.
• Certificate Mismatch: Because the node initializes as localhost, it generates a self-signed certificate for localhost, which fails Subject Alternative Name (SAN) validation when the installer attempts to connect via the intended FQDN.

Resolution

To resolve this issue, ensure the network environment and deployment specifications are appropriately configured before retrying the deployment:

1. Verify DNS and Hostname Resolution:

• Ensure the FQDN and IP address for the VCF Operations node are correctly registered in the DNS server.
• Verify that the FQDN is reachable and resolves to the correct IP from the VCF Installer machine.

2. Check Deployment Specification:

• Review the deployment JSON file for any formatting errors in the DNS or Network sections.
• Ensure there are no hidden spaces or special characters in the DNS server IP strings.

3. Verify Local Host Files:

• Check the /etc/hosts file to ensure the FQDN is not mapped to 127.0.0.1 or ::1. It should be mapped to the static IP assigned to the appliance.

4. Redeploy with Patched Version:

• If the issue persists, ensure you are using the latest patched version of the VCF 9.1 Installer, as initialization logic improvements may be included in newer builds.

5. Manual Intervention (If necessary):

• In some cases, manually setting the hostname on the deployed appliance using hostnamectl set-hostname <FQDN> and regenerating the deployment certificates may be required if the automated process fails to apply the identity.