VCF 9.1 vCenter installation failed with ssl thumbrint error "Failed to obtain vc thumbprint: Caused by SSLError Fingerprints did not match"

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• VCF 9.1 installer fails while deploying vCenter appliance with the error "Failed to obtain vc thumbprint: Caused by SSLError Fingerprints did not match"
• The following error is observed in the VCF Installer log 

/var/log/vmware/vcf/domainmanager/cli-installer-<date_and_time>/workflow_<id>/vcsa-cli-installer.log

YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Using certificate to connect to the server through SmartConnect
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Successfully found the target VCSA  on esxi <esxi hostname'
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Found FQDN of target appliance: <vCenter fqdn>
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Fetching VC Thumbprint...
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Proceed with certificate check...
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Using certificate to connect to the server through SmartConnect
YYYY-MM-DD hh:mm:ss  - vCSACliInstallLogger - DEBUG - Desired VM found, Fetching Fingerprint...
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - ERROR - Failed to obtain vc thumbprint: HTTPSConnectionPool(host='host fqdn', port=443): Max retries exceeded with url: /guestFile?id=5&token=xxxx-xxxxx-xxxxx-xxxxxx (Caused by SSLError('Fingerprints did not match. Expected "xxxxxxxxxxxxxxxxxxxxxxxxxxxx", got "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"'))

YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Proceed with certificate check...
YYYY-MM-DD hh04:18,997 - vCSACliInstallLogger - DEBUG - Using certificate to connect to the server through SmartConnect

YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - INFO - ================ [FAILED] Task: Running Datacenter Creation: Creating the new datacenter for vSphere vLCM managed cluster. execution failed at 09:05:06 ================
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - DEBUG - Task 'Running Datacenter Creation: Creating the new datacenter for vSphere vLCM managed cluster.' execution failed because [HTTPSConnectionPool(host='host fqdn', port=443): Max retries exceeded with url: /guestFile?id=5&token=xxxxx-xxxxxx-xxxxxx-xxxxxx (Caused by SSLError('Fingerprints did not match. Expected "xxxxxxxxxxxxxxxxxxxxxxxxxxx", got "xxxxxxxxxxxxxxxxxxxxxx"'))], possible resolution is [Refer to the logs for details]
YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - INFO - ================================================================================

YYYY-MM-DD hh:mm:ss - vCSACliInstallLogger - ERROR - Traceback (most recent call last):
  File "main.py", line 412, in <module>
  File "main.py", line 386, in main
  File "/build/mts/release/bora-25234746/src/bora/install/vcsa-installer/vcsaCliInstaller/tasking/workflow.py", line 777, in execute
  File "/build/mts/release/bora-25234746/src/bora/install/vcsa-installer/vcsaCliInstaller/tasking/workflow.py", line 765, in execute
  File "/build/mts/release/bora-25234746/src/bora/install/vcsa-installer/vcsaCliInstaller/tasking/taskflow.py", line 1007, in execute
  File "/build/mts/release/bora-25234746/src/bora/install/vcsa-installer/vcsaCliInstaller/tasking/taskflow.py", line 971, in _execute_single_threaded
tasking.taskflow.TaskExecutionFailureException: HTTPSConnectionPool(host='host fqdn', port=443): Max retries exceeded with url: /guestFile?id=5&token=xxxxx-xxxxx-xxxxx-xxxxx (Caused by SSLError('Fingerprints did not match. Expected "xxxxxxxxxxxxxxxxxxxxxxx", got "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"'))

 

Environment

VMware Cloud Foundation 9.1

Cause

SSL thumbprint mismatch between the certificates on the vCenter and that on the Esxi host. 

Resolution

Renew the Esxi host to self-signed certificate. 

• Take the SSH to the Esxi host server.
• Validate the ESX hostname and Fully Qualified Domain Name (FQDN).

  esxcli system hostname get

   

   

  If the FQDN is not configured correctly, you can edit it by running the command :

  esxcli system hostname set --fqdn=<

  NEW_FQDN>
• Regenerate the self-signed certificate by executing the below command :

  /sbin/generate-certificates

   
• Reboot the ESX host.