vCenter 8.x services fail to start with error "unsuitable certificate purpose" after Machine SSL replacement

Products

• VMware vCenter Server 8.0

Issue/Introduction

Symptoms:

• After replacing the vCenter Machine SSL certificate with a custom CA-signed certificate, services such as vmware-vpxd-svcs, vmware-certificatemanagement fail to start. The vCenter UI displays "no healthy upstream."
• vCenter vmon.log has error below:

YYYY-MM-DDTHH:MM:SS Wa(03) host-xxx <vpxd-svcs> Service pre-start command's stderr: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unsuitable certificate purpose (_ssl.c:1007)

• When user check the customized certificate for the problematic vCenter, the field "X509v3 Extended Key Usage" is with value "1.3.6.1.4.1.311.20.2.1".  Use command below to check the field:

openssl x509 -in <cert_file> -text -noout | grep -A 1 "Extended Key Usage"

• As comparison, the other good vCenter who uses a customized certificate does not have same value.

Environment

VMware vCenter Server 8

Cause

The custom certificate provided by the Enterprise CA includes the "1.3.6.1.4.1.311.20.2.1"  Extended Key Usage (EKU) attributes, this value is unsuitable for vCenter.

 

Resolution

 

• Ensure the CA template or request does not include the wrong  EKU OIDs "1.3.6.1.4.1.311.20.2.1". And re-generate new certificate from Enterprise CA.
• Apply the new certificate.