VCF Installer fails to connect to offline VMware depot with error "Secure protocol communication error"

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

When attempting to configure or connect to an offline VMware depot using the VCF Installer, the connection fails. The interface or log output displays an error stating that the secure protocol communication failed, despite providing the correct credentials.

Environment

The following error message is encountered during the validation or connection phase:

Failed to connect to VMware depot with the provided user credentials. Cause: Depot connection failure: Secure protocol communication error, host: 10.XX.XX.XX, http status code: . Please verify the depot credentials for user are correct, check your connection to the depot and try command again.

Cause

 

• VMware Cloud Foundation (VCF) 9.1

• VCF Installer VM

• Internal/Offline Depot Server (configured via HTTPD/Apache)

 

Resolution

This issue occurs because the VCF Installer Java truststore does not trust the custom or self-signed SSL/TLS certificate presented by the internal offline depot server (10.XX.XX.XX). Because the certificate chain cannot be verified natively by the installer's runtime environment, the handshake fails with a secure protocol communication error.

To resolve this issue, you must manually export the SSL certificate from the offline depot server and import it into the Java truststore on the VCF Installer VM.

Follow these steps to complete the process:

Step 1: Export the Depot Certificate

1. Log in to your offline depot server via SSH as root.

2. Run the following command to convert and export the Apache HTTPD server certificate into a .pem format:
   openssl x509 -in /etc/httpd/conf/server.crt -out /tmp/depot-cert.pem

Step 2: Copy the Certificate to the VCF Installer VM

1. Transfer the generated /tmp/depot-cert.pem file from the offline depot server over to the /tmp directory of the VCF Installer VM (using scp or your preferred file transfer method).

Step 3: Import the Certificate into the VCF Installer Truststore

1. Log in to the VCF Installer VM via SSH as root.

2. Execute the following keytool command to inject the certificate into the Java cacerts truststore:
   keytool -importcert -trustcacerts -alias vcf-depot -file /tmp/depot-cert.pem -keystore /usr/lib/jvm/openjdk-java21-headless.x86_64/lib/security/cacerts -storepass changeit -noprompt

3. Reboot the VCF Installer VM to apply the new truststore configurations:

         reboot

Step 4: Verify Connectivity

1. Once the VCF Installer VM finishes rebooting, log back into the deployment interface.

2. Retry establishing the connection to the offline depot server. The secure connection validation should now succeed.