"Error Call to Directory Service failed" during login in VMware Identity Manager

Products

• VCF Operations

Issue/Introduction

Directory syncs fail and users are unable to log in to VMware Identity Manager (vIDM) using directory accounts. Attempts to log in results in the error message: "Error Call to Directory Service failed."

Environment

VMware Identity Manager 3.3.7

Cause

The issue is caused by an invalid or incomplete SSL certificate chain on the AD server. Logs indicate a javax.net.ssl.SSLHandshakeException due to a java.security.SignatureException: certificate does not verify with supplied key. This typically occurs when root or intermediate certificates are incorrectly installed, leading to a chain where issuers are not properly aligned.

Resolution

To resolve this issue, ensure a valid and complete certificate chain is installed on the AD servers:

1. Identify the specific host(s) failing the handshake.
2. Verify the certificate chain currently being presented by the host(s) to ensure all intermediate and root certificates are present and valid.
3. If the chain is invalid, obtain the correct root and intermediate certificates directly from the Certificate Authority (CA).
4. Re-install the certificates on the AD server to establish a valid chain of trust.
5. Once the certificate chain is corrected, vIDM should be able to connect, authenticate, and sync with the directory again.