Unable to mount vSAN MAX datastore.

Products

• VMware vSAN

Issue/Introduction

• vSAN MAX datastore grayed out and not  selectable for a mount. 
• Some compute vSAN clusters are successfully mounted and use vSAN MAX Datastore. 
• Mounting vSAN MAX DS to another cluster fails.

Environment

• vSAN 8.0
• vCenter 8.0 build-24853646  

Cause

This is caused by a known issue in vCenter Prior to  8.0 Patch 08 (80p08).

When a server-side vCenter presents its certificate as a certificate chain (containing leaf + intermediate + root CA), the client vCenter's HCI Mesh connection layer incorrectly processes the chain, resulting in a malformed certificate header being sent on every connection attempt.

This causes persistent VsanSslVerifyCertFault errors and prevents the Property Collector from ever re-establishing a connection.

The fix for this is in vCenter 8.0 Patch 08 (80p08).

 

Resolution

There are two options to recover the server vCenter connection:

 

Option 1: Upgrade vCenter to 8.0 Patch 08

Upgrading both vCenter instances to 80p08 is the permanent resolution. This patch contains the fix  and will correctly handle certificate chains in HCI Mesh connections going forward.

Option 2: Update server vCenter machine certificate to a single (leaf-only) certificate and re-authenticate

This is the recommended workaround only if upgrading vCenter is not immediately feasible.

a. On the server vCenter update the machine SSL certificate to use a single leaf certificate instead of a certificate chain. Wait for the certificate renewal process to complete and confirm the new certificate is in effect. 
b. On the client vCenter, navigate in the vSphere UI to: Inventory > select the vCenter > Configure > vSAN > Remote Datastores > Datastore Sources. 
c. Select the problematic remote vCenter and click REAUTHENTICATE.
d. In the pop-up window, click Accept Certificate, then click OK. Wait for the task to complete in the Recent Tasks pane.
e. Connect to the client vCenter via SSH and restart the vSAN Health service:

f. Wait approximately one minute for the service to fully initialize, then verify the remote vCenter connection status in the UI.

Note: It is important to complete step (a) before proceeding with steps (b)–(f). If the server vCenter still presents a certificate chain after the REAUTHENTICATE, the issue will recur shortly after the restart due to an automatic certificate update triggered by the Property Collector.