Error: Unable to get TLS certificate for vCenter HTTP Reverse Proxy during Supervisor deployment

Products

• VMware vCenter Server

Issue/Introduction

vSphere with Tanzu Supervisor deployment is stuck in a "Configuring" state.

The workload management UI shows the following error:

/var/log/vmware/wcp/wcpsvc.log 

Unable to get TLS certificate for vCenter HTTP Reverse Proxy. Details HTTP request failed; GET, url: http://localhost:1080/rest/vcenter/certificate-management/vcenter/tls, code: 503, body: '{"type":"com.vmware.vapi.std.errors.service_unavailable"...

vCenter services related to certificate management or trust appear to be stopped or unhealthy.

Environment

VMware vSphere Kubernetes Service
VMware vCenter Server 8.x / 9.x
VMware Cloud Foundation (VCF) 5.x / 9.x

Cause

Critical vCenter services required for Supervisor deployment are in stopped or unhealthy state.

Resolution

1.Log in to the vCenter Server Appliance (VCSA) as root via SSH.

2. Check the status of all services:
service-control --status --all

3. Check for services vmware-certificateauthority, vmware-certificatemanagement, vmware-topologysvc to see if they are in stopped state.

4. Start the services using the commands below

service-control --start vmware-certificateauthority
service-control --start vmware-certificatemanagement
service-control --start vmware-topologysvc

5. If multiple services are down, restart all services using the command:

service-control --start --all

6. Deactivate the current Supervisor deployment in the vSphere Client to ensure a clean state.

7. Redeploy the Supervisor services.

Additional Information

For steps to download the latest releases, see Download Broadcom Products and Software. 
To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.