Error: VCHA is down unable to redeploy passive vm during node redeployment

Products

• VMware vCenter Server

Issue/Introduction

• vCenter High Availability cluster status displays as "Down" or "Degraded" in the vSphere Client.
• Attempts to redeploy the passive node fail with certificate mismatch or trust errors.
• vCenter services fail to start on the standalone node because the start profile is locked to HACore.
• Error: "VCHA is down unable to redeploy passive vm" is reported during cluster maintenance.

Environment

VMware vCenter Server 8.x.

Cause

Modification of Machine SSL or VMDIR certificates on the Active node while the cluster is active breaks the secure link and synchronization required for database replication and heartbeats.

Resolution

1. Destroy the VCHA Configuration:
   • Navigate to vCenter Server > Configure > vCenter HA.
   • Click Remove VCenter HA.
   • Refer to KB 427313 for detailed removal steps.
2. Perform Certificate Maintenance:
   • Run the vSphere Certificate Manager: /usr/lib/vmware-vmca/bin/certificate-manager.
   • Replace or renew the required certificates.
   • Restart services: service-control --stop --all && service-control --start --all.
   • Note: If services fail to start, ensure the /storage/vmware-vmon/defaultStartProfile is set to ALL.
   • Refer to the KB 318754 for detailed information on vCenter High Availablity enablement fails due to HACore profile startup failure and vmware-statsmonitor service startup timeout
3. Reconfigure VCHA:
   • Log into the vSphere Client and verify the node is healthy.
   • Navigate back to vCenter Server > Configure > vCenter HA.
   • Click Set Up vCenter HA to deploy fresh Passive and Witness nodes. These nodes will automatically inherit the correct certificate trust chain from the Active node
   • Refer the following techdocs that gives you detailed information about how to configure HA with the vSphere Client : Configure vCenter HA With the vSphere Client

Additional Information

FAQ: vCenter High Availability

 Cluster 'Down' or 'Degraded' status may also result from temporary network latency affecting UDP heartbeats on port 902. If certificate synchronization is verified, investigate environmental network stability.