Microsoft Certificate Authority (MSCA) Integration Failures in SDDC Manager.

Products

• VCF Operations
• VMware SDDC Manager / VCF Installer

Issue/Introduction

• In the SDDC Manager UI, you encounter an error when attempting to configure the Microsoft Certificate Authority.
  
  
  
  
  
• The /var/log/vmware/vcf/operationsmanager/operationmanager.log file on the SDDC Manager appliance shows the following stack trace:
  
  YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,0000000000000000,0000] [c.v.v.c.ca.plugin.MicrosoftCaService,om-scheduler-1] Unable to retrieve certificate from Microsoft CA
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,0000000000000000,0000] [c.v.v.c.ca.plugin.MicrosoftCaPlugin,om-scheduler-1] Unable to fetch Microsoft CA certificate
com.vmware.vcf.certmgmt.common.exception.CertificateManagementException: java.net.SocketException: Connection reset
        at com.vmware.vcf.certmgmt.ca.plugin.MicrosoftCaService.retrieveCertificate(MicrosoftCaService.java:353) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.lang.RuntimeException: java.net.SocketException: Connection reset
        at com.vmware.vcf.secure.http.HttpClientService.execute(HttpClientService.java:1206)
        at com.vmware.vcf.certmgmt.ca.plugin.MicrosoftCaService.retrieveCertificate(MicrosoftCaService.java:338)
  

Environment

SDDC 9.x

Cause

This issue occurs due to one of the following reasons:

• The Certificate Authority Template is not correctly configured for use with SDDC Manager.
• The user account used in SDDC Manager for CA integration lacks the required permissions on the Microsoft CA.

Resolution

To resolve this issue, ensure the Microsoft Certificate Authority is properly prepared:

1. Configure Certificate Template: Verify that a template has been created and added specifically for SDDC Manager.
2. Verify Permissions: Ensure the service account configured in SDDC Manager has the Issue and Manage Certificates and Request Certificates permissions on the CA server and the specific template.

Additional Information

For further information, please refer to Create and Add a Microsoft Certificate Authority Template.