VMware Live Recovery UI error 'A server error occurred' due to SSL Trust Mismatch

Products

• VMware Live Recovery

Issue/Introduction

Symptoms:

• The following issue occurs while attempting to access the VMware Live Recovery UI via a web browser:
  
  "A server error occurred"
  
  
  
  
• vSphere Replication status shows as "Not accessible" or "Disconnected" in the Site Recovery UI.
• Running lsdoctor.py -l on the vCenter Server reports: ERROR generateReport: ... found SSL Trust Mismatch.
• HMS logs (/opt/vmware/support/logs/srm/hms.log) reports: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate chain is not trusted.

Environment

VMware Live Recovery 9.x

Cause

SSL trust mismatches exist within the vCenter Lookup Service. This occurs when vCenter certificates are replaced or renewed, but the internal service registrations retain stale certificate thumbprints.

Resolution

IMPORTANT: Stopping all vCenter services (Step 8) will cause an immediate management outage for the vSphere environment. Perform this only during a maintenance window.

1. Take a powered-off snapshot of the vCenter Server Appliance (and all nodes in the SSO domain if using Enhanced Linked Mode).
2. Download the lsdoctor tool from Using the 'lsdoctor' Tool (KB 320837).
3. Transfer the lsdoctor.zip file to the /tmp directory of the vCenter Server.
4. SSH into the vCenter Server as root.
5. Navigate to the directory and extract the tool: cd /tmp && unzip lsdoctor.zip.
6. Execute the trust fix script: python lsdoctor.py --trustfix.
7. Enter the SSO administrator password when prompted.
8. Restart all vCenter services for changes to take effect: service-control --stop --all && service-control --start --all.
9. Log into the VMware Live Recovery VAMI (https://<appliance-ip>:5480) and select Reconfigure to update the connection to vCenter.

Additional Information

• Refer to Using the 'lsdoctor' Tool (KB 320837) for tool updates and diagnostic options.
• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.