ESXi Host Update via LCM Fails Due to Untrusted RecoverPoint EAM Agency Certificate

Products

• VMware vCenter Server

Issue/Introduction

VMware Cloud Foundation (VCF) Lifecycle Management (LCM) fails to successfully update ESXi hosts. This operation is blocked because the IOFILTER agency for RecoverPoint is not in a green state.

Subsequent attempts to remove the IOFILTER and ESX Agent Manager (EAM) agency for RecoverPoint fail, as virtual machines are flagged as actively using the IOFILTER. Furthermore, an in-place upgrade of the IOFILTER to update the EAM certificate fails, resulting in a specific error code presented in the vSphere Client.

Environment

vCenter 8.0

Cause

The vCenter Server EAM agent does not trust the certificate currently presented by the RecoverPoint EAM agent URL. This untrusted certificate prevents the IOFILTER EAM agency from entering a green state, which subsequently blocks LCM from performing ESXi host updates.

Resolution

• Connect to the vCenter Server Appliance (vCSA) via SSH and log in as root.

• Execute the eam-utility.py script to force the EAM agent to manually install and trust the certificate presented by the RecoverPoint URLs: /usr/lib/vmware-eam/bin/eam-utility.py install-cert https://RECOVERPOINTURL

• Restart the EAM agent service to apply the trusted certificate state: service-control --restart eam

• Monitor the vSphere Client to verify that the EAM agent processes complete and transition the agency to a green state.

• Retry the ESXi host patch operation via LCM.

Additional Information

EAM API call fails with CertificateNotTrustedFault or EAM agent has CertificateNotTrusted issue.