OVF/OVA upload failed with 'file_in_wrong_order_error' in Content Library

Products

• VMware vCenter Server

Issue/Introduction

When uploading an OVF or OVA template to the VMware Content Library—either via the vSphere Client (GUI) or the SDK/API—the task failed with the following error.

 - vSphere Client 

 

 - /var/log/vmware/content-library/cls.log

YYYY-MM-DDThh:mm:ss.uuuZ | ERROR    | ########-####-####-####-########2fd9-fa | cls-simple-activity-10    | SimpleActivityWorker           | Exception will not be handled by activity AddUpdateFileActivity (handle=########-####-####-####-########a14b, entityId=########-####-####-####-########5fae): InvalidArgument (com.vmware.vapi.std.errors.invalid_argument) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = com.vmware.vdcs.cls-main.file_in_wrong_order_error,
    defaultMessage = Error adding file <OVF_NAME>.cert to the update session ########-####-####-####-########5fae. Manifest file and certificate file should be added before the OVF descriptor and all other files.,
    args = [<OVF_NAME>.cert, ########-####-####-####-########5fae],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = INVALID_ARGUMENT
}

 

Environment

vCenter Server 8.0U3 and later

Cause

This error occurs when an OVF package includes a Certificate (.cert) file but the Manifest (.mf) file is missing from the upload or is uploaded out of sequence.

The Content Library service has a validation policy for signed templates:

1. When validating template authenticity with a Certificate (.cert) file, the Manifest (.mf) file containing file hashes must also be present.
   
   
2. To establish the trust chain for the OVF descriptor and data disks, the service expects the .mf file to be processed prior to the .cert file.

Starting in vCenter Server 8.0U3, the Content Library enforces a stricter validation policy for signed templates. If a Certificate (.cert) file is included without the corresponding Manifest (.mf) file, the service cannot verify the template's authenticity and the upload fails.

Resolution

To successfully upload the template, use one of the following methods:

Method 1: Include All Signature Files

When selecting files for upload in the vSphere Client (or defining the session in the SDK), ensure you include the Manifest file:

Required Files: .ovf, .vmdk (all disks), .mf, and .cert.

 

Method 2: Upload as an Unsigned Template

If you do not require the template to be verified by a certificate:

Required Files: .ovf and .vmdk (all disks) only.

Exclude: Both the .mf and .cert files.

 

Note: Method 1 is recommended because the manifest (.mf) file contains hash values to verify the integrity of the OVF package. This allows vSphere to detect any file corruption or tampering before deployment.