VCF Automation SSO Integration Fails with Error: "I/O error on POST request... certificate_unknown(46)"

Products

• VCF Operations

Issue/Introduction

When attempting to use or configure Single Sign-On (SSO) integration within VCF Automation, authentication fails, and the integration does not function as expected.

Within the user interface, the VCF Automation integration for All Organizations is displayed in a Warning state, and the following error message is logged.

I/O error on POST request for https://<FQDN_or_IP>: certificate_unknown(46)

Environment

VCF Operations 9.1.x

VCF Identity Broker 9.1.x

Cause

The SSO integration failure and SSL handshake errors are caused by a legacy Fleet Management virtual machine remaining powered on and active after system convergence.

Leaving the deprecated appliance running creates a dual-active service conflict and a certificate trust mismatch. When VCF Automation attempts to authenticate, traffic routes unpredictably or encounters conflicting SSL certificates between the legacy Fleet Management VM and the newly converged VCF Operations environment, resulting in HTTP 403 errors or SSL certificate rejections.

Resolution

Follow this procedure in order to safely retire the legacy appliance, clear the warning state, and restore healthy SSO connectivity.

1.Locate the Legacy VM: Access the vSphere Client inventory. Log in to your vSphere Client and locate the legacy Fleet Management virtual machine. Do not power it off yet.

 

2.Verify Data Convergence:  Do not proceed if components are missing from inventory. Navigate to VCF Operations → Lifecycle → VCF Management → Components. Confirm that all required components have already been successfully imported into the VCF Operations Components Inventory as part of your data convergence process.

 

3.Power Off the Legacy VM: Prevents IP and service conflicts with the converged environment. Return to the vSphere Client and safely power off the legacy Fleet Management virtual machine.

 

4.Verify Endpoint Shutdown: Confirm stale services are no longer responding. Run the following command from your VCF Operations primary node to verify that stale services (such as ops-lcm) are no longer responding from the legacy IP or VM:

curl -k -u admin:<ops-admin-password> https://<ops-node-ip>/casa/services

 

5.Re-test SSO Integration: Return to VCF Automation and trigger a re-test of the SSO integration.