VCF 9.x Deferred Installation Fails with "Actual certificate thumbprint doesn't match"

Products

• VMware SDDC Manager / VCF Installer
• VCF Operations

Issue/Introduction

When attempting a deferred installation of VCF Operations or VCF Automation via the VCF Installer, the deployment fails during the "VSP component installation" or "Prepare input for importing existing VCF Operations deployment" tasks.

The following error is observed in the UI:

The Fleet lifecycle 'VSP component installation' task failed. Internal errors: A pre-validation prevented the bootstrap.

In the /var/log/vmware/vcf/domainmanager/domainmanager.log on SDDC Manager, you find:

ERROR [c.v.v.v.SddcManagerPublicApiClientFactory] Failed to create an API client for SDDC Manager at [FQDN] Caused by: java.lang.RuntimeException: Actual certificate thumbprint doesn't match provided one for address '[FQDN]'

Environment

• VMware Cloud Foundation 9.x

Cause

This issue occurs when the SDDC Manager database contains stale or "NOT_STARTED" entries for management components. This typically happens if a previous deployment attempt failed or was partially completed, causing the Fleet Lifecycle (Fleet LCM) orchestrator to cache an incorrect SSL thumbprint for the target FQDN.

Strict certificate validation in VCF 9.x prevents the API client from connecting when the cached thumbprint in the platform database does not match the live certificate presented by the appliance.

Resolution

Prerequisites

• Take a snapshot of the SDDC Manager VM before modifying the database.
• Ensure the target component certificates include both the FQDN and IP Address in the Subject Alternative Name (SAN) field.

Steps

1. Identify Stale Entries: SSH into the SDDC Manager appliance as the vcf user, switch to root, and log into the Postgres database:

      psql -h localhost -U postgres -d platform

    2. Run the following query to identify components stuck in a NOT_STARTED state: 

          select * from vcf_management_component where deployment_status = 'NOT_STARTED';

   3.Clear Database Metadata: If entries are returned, delete them to allow the orchestrator to perform a fresh discovery:

         delete from vcf_management_components where deployment_status = 'NOT_STARTED';

  4. Clear Trusted Certificates (If Applicable): In the VCF Operations UI, navigate to Administration > Trusted Certificates. Remove any existing certificates for the FQDN listed in the error message

  5. Verify API Specification: Ensure you are using the correct VCF Installer API specification for deferred deployment rather than general SDDC Manager APIs. Refer to the official VCF 9.1 Deployment Guide.

  6. Retry Deployment: Return to the VCF Installer UI and click Retry on the failed task.