Host Commissioning Fails at 39% with NoRouteToHostException and checkTime Certificate Errors in SDDC Manager

Products

VMware vSphere ESXi 8.0 VMware SDDC Manager / VCF Installer

Issue/Introduction

During the host commissioning process in SDDC Manager, the workflow consistently fails at 39% in the subtask Install Temporary VMCA Certificate For Host Commissioning.

/var/log/vmware/vcf/domainmanager/domainmanager.log reports that the task fails with an unexpected network layer exception:

ERROR [vcf_om,...] Failed to connect to https://<ESXi_FQDN>:443/sdk invocation failed with "java.net.NoRouteToHostException: No route to host"

In /var/log/vmware/vcf/operationsmanager/operationsmanager.log, detailed traces show the ESXi host rejecting certificate installation due to timestamp verification:

WARN [vcf_om,...] Failed to install certificate on host. Retrying com.vmware.vcf.certmgmt.esxi.exception.ESXiHostCertificateException: (vim.fault.HostConfigFault) {
  key = vim.hostd.vimsvc.certificatemanager.checkTime
  message = Time validation failed. Check host Time and/or Certificate expiration data (notBefore, notAfter).
}

Network checks (ping, nslookup and curl -k -v https://<ESXi_FQDN>:443) from the SDDC Manager appliance shell confirm that TCP port 443 and IP routing are open, but NTP polling on the ESXi host returns a null address lookup.
1. This can be seen either when checking the status via ntpd:
```
# ntpd -q -g -c /etc/ntp.conf
```
2. Or as log message:
```
<NTP_Server_IP> local addr <Host_IP> -> <null>
```

Environment

VMware SDDC Manager 5.x
VMware vSphere ESXi 8.0.x

Cause

Firewalls or Access Control Lists (ACLs) are actively blocking outbound UDP Port 123 (NTP) traffic between the new ESXi hosts' management subnet and the designated upstream Network Time Protocol (NTP) servers.
Due to the blocked network path, the newly installed ESXi hosts rely on hardware CMOS clocks, causing them to drift several minutes out of sync with SDDC Manager.
During host commissioning, SDDC Manager generates a temporary VMCA certificate. Because of the clock skew, the ESXi host evaluates the certificate timestamp as "not yet valid" (notBefore) or already expired, invoking the checkTime fault.
When the ESXi hostd agent abruptly drops the connection during the TLS handshake, Java socket handlers in SDDC Manager record the dropped socket as a generic java.net.NoRouteToHostException.

Resolution

To solve this issue, apply the following steps:

Unblock Network Firewall Rules:
- Configure upstream network firewalls and router ACLs to permit bidirectional traffic over UDP Port 123 (NTP) between the ESXi management network and the NTP servers.
Synchronize Clocks across ESXi Hosts:
Once the firewall rule is applied, force an immediate time synchronization on each affected ESXi host via SSH:
- Open an SSH session with the ESXi host and login as root.
- Stop the NTP daemon:
```
# /etc/init.d/ntpd stop
```
- Set the correct NTP servers:
```
# esxcli system ntp set --server=<ntp_server_1_fqdn> --server=<ntp_server_2_fqdn> --enabled=true
```
- Force an immediate time step sync:
```
# ntpd -q -g -c /etc/ntp.conf
```
- Restart the NTP daemon and the management agent:
```
# /etc/init.d/ntpd start
# /etc/init.d/hostd restart
```
- Verify the current time matches SDDC Manager down to the second:
```
# date
```
Clear SDDC Manager Microservice Cache
- Log into the SDDC Manager appliance via SSH as root.
- Restart the core orchestrator daemons to flush the cache:
```
# systemctl restart domainmanager operationsmanager sddc-manager-ui-app
```
Retry the Workflow:
- Refresh the SDDC Manager browser interface (Ctrl + F5).
- Locate the failed host commissioning task.
- Click RESTART TASK.

Additional Information

Unable to add ESXi host to vCenter with error: "Unable to push signed certificate to host"
Unable to add a standalone ESXi host to vCenter