SDDC Manager UI login fails with 500 Identity Internal Server Error when using IP address
search cancel

SDDC Manager UI login fails with 500 Identity Internal Server Error when using IP address

book

Article ID: 447882

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

  • You are unable to access the SDDC Manager UI using the IP address of the SDDC Manager appliance.
  • You receive the error message: 500 - {"errorCode":"IDENTITY_INTERNAL_SERVER_ERROR","arguments":[],"message":"Identity Internal Server Error","referenceToken":"####"}.
  • You find that access via the Fully Qualified Domain Name (FQDN) works correctly, but access via the IP address fails during the login phase.

Environment

SDDC 4.x
SDDC 5.x

Cause

This issue occurs because the SDDC Manager SSL certificate is either expired or does not include the IP address in the Subject Alternative Name (SAN) field.

When you attempt to log in via the IP address, the identity services encounter a certificate mismatch or an invalid trust path, resulting in the following exception in the logs: 

/var/log/vmware/vcf/commonsvcs/vcf-commonsvcs.log

Caused by: com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Resolution

To restore access to the SDDC Manager UI, you must use one of the following methods:

Method 1: Use FQDN (Workaround)

Access the SDDC Manager UI using the Fully Qualified Domain Name (FQDN) instead of the IP address. This aligns the request with the existing certificate parameters and circumvents the SAN mismatch.

Method 2: Update the SDDC Certificate (Permanent Fix)

If you require direct access to the UI via an IP address, you must regenerate the SDDC certificate to include the IP as a SAN:

  1. Log in to the SDDC Manager via SSH.
  2. Verify the current certificate health by running: /opt/vmware/sddc-support/sos --certificate-health
  3. If the certificate is expired or missing the IP SAN, follow the documented steps in KB 336778 to regenerate the SDDC Manager SSL certificate.
  4. Ensure that during the CSR (Certificate Signing Request) generation, the IP address is explicitly defined in the SAN field.
Powered by Wolken Software