Envoy proxy service fails to start after upgrading to vSphere Replication 9.0.2.3
search cancel

Envoy proxy service fails to start after upgrading to vSphere Replication 9.0.2.3

book

Article ID: 449328

calendar_today

Updated On:

Products

VMware Live Recovery

Issue/Introduction

Symptoms:

  • After upgrading the vSphere Replication (VR) appliance from version 9.0.2.1 or 9.0.2.2 to 9.0.2.3, the Virtual Appliance Management Interface (VAMI) at https://<VR_FQDN>:5480 is inaccessible.

  • The VR appliance appears as "Not Accessible" in the Site Recovery plugin.

  • Post upgrade of VR appliance to 9.0.2.3, the envoy-proxy service is not running and fails to start/restart:
    root@vr [/] systemctl status envoy-proxy.service
    envoy-proxy. service - Envoy proxy service
            Loaded: loaded (/usr/lib/systemd/system/envoy-proxy.service; enabled; vendor preset: enabled)
            Active: activating (auto-restart) (Result: exit-code) since Wed 2026-07-22 05:02:22 UTC; 6s ago
            Process: 2956 ExecStart=/opt/vmware/envoy/bin/envoy.sh (code=exited, status=1/FAILURE)
           Main PID: 2956 (code=exited, status=1/FAILURE)

Environment

VMware vSphere Replication 9.0.2.3

Cause

  • The envoy-proxy service fails to start because the envoy-proxy.yaml configuration file incorrectly references the /etc/ssl/certs directory as a file.

  • This can be observed in the VR appliance's /var/log/vmware/envoy/envoy.log:

    2026-07-22T05:02:22.903Z critical envoy[2956] [Originator@6876 sub=main] error 'file /etc/ssl/certs is empty' initializing config ' /opt/vmware/envoy/conf/envoy-proxy.yaml'
    2026-07-22T05:02:22.903Z info envoy[2956] [Originator@6876 sub=main] exiting

  • The envoy-proxy service functions as the edge gateway and reverse proxy for the appliance, routing external API and user interface traffic to the appropriate internal microservices.

  • Since it fails to start up, the VAMI page remains inaccessible post VR upgrade.

  • Upon investigation, /etc/ssl/certs was found to be a non-empty directory containing multiple files rather than being a file itself.

  • The envoy-proxy startup config file /opt/vmware/envoy/conf/envoy-proxy.yaml, references the /etc/ssl/certs as a file:

    trusted_ca:
         filename: /etc/ssl/certs

Resolution

To resolve the issue, perform the following steps:

  1. Take snapshot of the VR appliance and upgrade it to version 9.0.2.3.

  2. Open an SSH session to the vSphere Replication appliance as root.

  3. Change the directory to the configuration path: cd /opt/vmware/envoy/conf

  4. Back up the existing configuration file: mv envoy-proxy.yaml envoy-proxy.yaml-old

  5. Replace it with the envoy-proxy.yaml.rpmnew file, which is already available in the same path: mv envoy-proxy.yaml.rpmnew envoy-proxy.yaml

  6. Manually start the envovy-proxy service: systemctl start envoy-proxy.service

  7. Verify access to the VAMI page. (https://<VR_FQDN>:5480)

Powered by Wolken Software