Remote site vCenter not collecting data in VCF Operations after certificate change

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VCF Operations

Issue/Introduction

• vCenter server adapters in VCF Operations may stop collecting data or enter a "Warning" state after a vCenter SSL certificate renewal, even if basic connectivity tests appear successful.
• Collection may timeout for vCenter server is located in a remote site (with high network latency), preventing localized data retrieval.

Environment

• Aria Operations 8.18.x
• VCF Operations 9.x

Cause

This issue typically occurs due to a combination of trust store discrepancies and infrastructure configuration bottlenecks:

• Trust Store Mismatch: VCF Operations maintains a trusted certificates store for integrated endpoints. When a vCenter certificate is replaced, the old certificate remains in the trusted store while the new SSL certificate (or its Root/Intermediate CA chain) may not be fully trusted yet. This can lead to hidden SSL handshake exceptions (such as PKIX path building failed) during the data collection cycle, even if a basic connection test seemingly passes.
• Remote Configuration Constraints: The environment may lack adequate remote site monitoring capabilities, such as a localized proxy, preventing localized data retrieval.
• Infrastructure Bottlenecks: Lingering snapshots on the vCenter server, pending reboots, or resource constraints (CPU/Memory crunch) on the vCenter server appliance can halt/delay data collection processes.

Resolution

To resolve this issue, perform the following troubleshooting steps, combining certificate management and managing remote data collection via cloud proxies:

1. Update the VCF Operations TrustStore: Log in to the VCF Operations UI as admin user.
   1. Navigate to Administration ➔ Control Panel ➔ Trusted Certificates.
   2. Locate and delete the old or expired certificate previously issued to the affected vCenter Server.
   3. If using a CA-signed certificate, manually import the new Root/Intermediate CA certificates into the Trusted Certificates store.
   4. Navigate to Administration ➔ Integrations (or Accounts), select the affected vCenter adapter, and click Edit.
   5. Scroll to the bottom, click Validate Connection, review and accept the new certificate thumbprint when prompted, and click Save. Data collection should typically resume within 5–10 minutes.
2. Deploy a Cloud Proxy: Deploy a right-sized cloud proxy in the specific remote region to handle remote site monitoring. For additional guidance, refer to VCF Operations product guidance for configuring cloud proxies.

Additional Information

Below are steps to enhance the data collection times on remote site vCenter server(s):

1. Remove Snapshots: Delete any existing snapshots currently running on the vCenter server.
2. Perform a Reboot: Plan and schedule a full reboot of the vCenter server.
3. Increase Resources: Assess the affected vCenter server(s) for a resource crunch. If resource limits are being exceeded, consider increasing the CPU and Memory allocation, referencing the standard hardware and storage requirements for the vCenter Server Appliance.

Refer: Integrating Data Sources with VCF Operations