Error: "Unable to connect to VC: Duplicate key" when adding VCF adapter in VCF Operations UI

Products

• VCF Operations

Issue/Introduction

• Integration of VMware Cloud Foundation (VCF) within the VCF Operations UI fails during or after deployment. The following error appears in the UI:
  
  Unable to connect to VC: Duplicate key ############################################# (attempted merging values com.integrien.alive.common.adapter3.config.CertificateConfig@###### and com.integrien.alive.common.adapter3.config.CertificateConfig@######)
Please check connectivity.
VC extensions info check task failed
  
  
• The following errors will appear in the specified paths on the VCF Operations appliance:
  
  /storage/log/vcops/log/adapters/ManagementAdapter/ManagementAdapter.log

YYYY-MM-DDTHH:MM:SS ERROR ManagementAdapter ####### [ops@#### threadId="#####" threadName="TasksManager-TaskHandler-####" instanceId="##"] [(##) com.vmware.adapter.management.components.extensions.VcExtensionsComponent.getExtensionInfoForVc] - Unable to connect to VC
java.lang.IllegalStateException: Duplicate key ############################################ (attempted merging values com.integrien.alive.common.adapter3.config.CertificateConfig@###### and com.integrien.alive.common.adapter3.config.CertificateConfig@######)

/storage/log/vcops/log/web.log

YYYY-MM-DDTHH:MM:SS ERROR web ###### [ops@#### threadId="######" threadName="ajp-nio-127.0.0.1-####-exec-###"] [com.vmware.vcops.ui.util.PreResultInterceptor.processErrors] - functionName = saveVCFCloudAccount, succeededPartially = false, errorMessage = Unable to
connect to VC: Duplicate key ############################################### (attempted merging values com.integrien.alive.common.adapter3.config.CertificateConfig@####### and com.integrien.alive.common.adapter3.config.CertificateConfig@######) Please
 check connectivity.
VC extensions info check task failed
  
  
• The referenced thumbprint is not found within the VCF Operations Trusted Certificates store.
  
  
• The connection task fails when merging certificate values due to a structurally invalid or misconfigured vCenter machine SSL certificate chain.

Environment

VCF: 9.0, 9.1

Cause

The vCenter Machine SSL certificate chain contains structural inconsistencies. This typically involves a duplicate intermediate certificate entry or a missing root certificate within the VECS MACHINE_SSL_CERT store. VCF Operations fails to merge the certificate configuration when it encounters identical thumbprints for different entries in the provided chain.

Resolution

1. Take a snapshot of the vCenter and SDDC Manager servers.
   
   
2. Log in to the vCenter via SSH as root.
   
   
3. Back up the current Machine SSL certificate and its key using the following commands:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /var/core/Machine_SSL.cer
/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /var/core/Machine_SSL.key
   
   
4. Run the following command to remove the invalid machine SSL certificate chain from the SSL store:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CERT -y
   
   
5. Create a valid certificate chain file (e.g., /var/core/new_chain.cer) ensuring it contains the Leaf > Intermediate > Root certificates in order, with no duplicate entries.
   
   
6. Publish the new SSL certificate into the machine SSL store:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli entry create --store MACHINE_SSL_CERT --alias __MACHINE_CERT --cert /var/core/new_chain.cer --key /var/core/Machine_SSL.key
   
   
7. Force a refresh of the certificate store:
   
   /usr/lib/vmware-vmafd/bin/vecs-cli force-refresh
   
   
8. Run the following command from SDDC Manager to retrieve and verify the vCenter SSL certificate chain: openssl s_client -connect vCenter_FQDN:443 -showcerts
   
   Note: If the command does not return the expected certificate chain, the previous changes may not have taken effect due to caching within the vCenter. To resolve this, reboot the vCenter to clear the stale cache, and then rerun the command to verify the output.
   
   
9. Proceed to re-add the VCF adapter to the VCF Operations integration.