vCenter Lifecycle Manager sync fails when using wildcard (*) wildcard in proxy bypass settings

Products

• VMware vCenter Server

Issue/Introduction

When configuring proxy settings in vCenter Server 8.x, you experience the following symptoms:

• vCenter Lifecycle Manager (vLCM) fails to sync or download from online/internal depots (e.g., HPE OneView, Broadcom).

• The vmware-vum-server.log contains errors such as:

  curl_easy_perform() failed: cURL Error: Peer certificate cannot be authenticated with given CA certificates or 403 Forbidden.

• If the wildcard (*) is removed from the NO_PROXY (Bypass) list to fix vLCM, then OVF/OVA deployments fails

Environment

VMware vCenter Server 8.0.x

Cause

vCenter Server 8.x uses curl for vLCM and other internal download tasks. In curl, an wildcard (`*`) in the NO_PROXY environment variable is treated as a literal character rather than a wildcard.

Because vCenter components like OVF Deployment may interpret the wildcard differently, using a syntax like ".*.example.com" creates a conflict where one service works while the other fails.

Resolution

To resolve this use domain suffixes without the wildcard in the bypass list.

If wildcard is needed then add all URLs (e.g., HPE OneView, Broadcom) to the proxy.

• SSH to vCenter appliance with root user.

• Modify the /etc/sysconfig/proxy file and add the FQDN's or IP's to the following line, separated by a comma followed by a space character.

• In the Proxy bypass settings, replace any instances of  .*.domain.com with either .domain.com or simply domain.com.

  • Correct Syntax:"localhost, 127.0.0.1, .example.com, example.com"

  • Incorrect Syntax:"localhost, 127.0.0.1, .*.example.com"

• If the proxy performs SSL Interception, ensure the Proxy CA chain is published to the vCenter TRUSTED_ROOTS store as outlined in KB 326301.

• Restart the Update Manager service:
  service-control --restart vmware-updatemgr