vCenter upgrade precheck fails with "Unable to run vCenter NTP server check" due to Proxy Configuration

Products

• VMware vCenter Server
• VMware Cloud Foundation

Issue/Introduction

• Upgrading vCenter Server from 9.0 to version 9.1 fails during the Stage 1 pre-upgrade check.
• Error displayed: Unable to run vCenter NTP server check.

• NTP configuration in the vCenter Management Interface (VAMI) appears correct and NTP servers are pingable.
• Log entries in /var/log/vmware/applmgmt/applmgmt.log or update_microservices.log may show UNAUTHENTICATED, 403 Forbidden or socket.timeout errors when attempting to verify NTP status.
  
  

  2026-06-24T13:21:08.864Z ERROR applmgmt-update-microservice 118519 [vc@4413 module="ntp_precheck" funcName="checkNtpServers" lineNum="57"] Unable to retrieve NTP servers. err: {HTTPSConnectionPool(host='abc.abc', port=443): Max retries exceeded with url: /api (Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden')))}

   

Environment

VMware Cloud Foundation 9.x

Cause

Issue with the proxy configuration in vCenter, disallowing the vCenter to connect to itself.

The vCenter Server Appliance is configured to utilize an external HTTP/HTTPS proxy, but the local Primary Network Identifier (PNID) has not been correctly excluded from proxy routing. During the NTP precheck validation, the applmgmt microservice attempts to query its own local VAPI endpoint (/api) on port 443. Because the PNID is absent from the NO_PROXY exception list, the request is routed out to the external proxy server, which subsequently rejects the internal connection with a 403 Forbidden error. 

Resolution

Please check if the file /etc/sysconfig/proxy contains the vCenter PNID, localhost and 127.0.0.1 for the NO_PROXY variable:

Remediation Workflow

Warning: Modifying the appliance network properties and proxy settings can disrupt infrastructure communications. Ensure a consistent, offline file-based backup and/or offline snapshot of the vCenter Server Appliance is captured before proceeding.

 

1. Connect to the vCenter Server Appliance via SSH using root credentials.

2. Enable the bash shell by running:

   shell
   

3. Retrieve the precise vCenter PNID to verify the exact string expected in the exclusion list:

   /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost
   

4. Open the proxy configuration file using vi or a preferred text editor:

   vi /etc/sysconfig/proxy
   

5. Modify the NO_PROXY variable to explicitly include localhost, 127.0.0.1, and the vCenter PNID (e.g., <REDACTED_HOSTNAME>):

   NO_PROXY="localhost, 127.0.0.1, <REDACTED_HOSTNAME>"
   

6. Save and exit the configuration file.

7. Restart the vCenter Server Appliance to commit the changes and apply the environment variables globally:

   reboot
   

8. Once the vCenter Server Appliance is back online and all core services are running, retry the vCenter 9.1.0.0100 upgrade precheck sequence.

Additional Information

Related documenation:

How to configure Network Time Protocol (NTP) on vCenter Server Appliance (VCSA)

File-Based Backup fails on vCenter Server 7.0 configured with a proxy

Cannot connect to proxy error while configuring Proxy via VAMI page.