vSphere Lifecycle Manager remediation fails with "VIB contains an invalid or corrupted signature"
Article ID: 449493
Updated On:
Products
Issue/Introduction
Symptoms:
- The remediation task in vLCM fails with the error "VIB contains an invalid or corrupted signature".
- ESXi host system time is correct.
- The VIB is a third-party driver or software package.
- In the ESXi host /var/log/lifecycle.log file, entries similar to the following are recorded:
YYYY-mm-DDTHH:MM:SS.zzzZ Db(15) lifecycle[####]: Vib:2128 Verifying VIB ##VIB_NAME## signature #1
...
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11)[+] lifecycle[####]: ##VIB_NAME##: ('##VIB_NAME##', 'Could not find a trusted signer: unable to get local issuer certificate')
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 Traceback (most recent call last):
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 File "/lib64/python3.8/site-packages/vmware/esximage/HostImage.py", line 909, in _download_and_stage
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 arvib.VerifyAcceptanceLevel()
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 File "/lib64/python3.8/site-packages/vmware/esximage/Vib.py", line 2080, in VerifyAcceptanceLevel
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 policyobj.Verify(self)
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 File "/lib64/python3.8/site-packages/vmware/esximage/AcceptanceLevels.py", line 144, in Verify
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 self.VerifySignature(vib, checkCertDates)
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 File "/lib64/python3.8/site-packages/vmware/esximage/AcceptanceLevels.py", line 209, in VerifySignature
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 signer = vib.VerifySignature(self.verifyobj,
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 File "/lib64/python3.8/site-packages/vmware/esximage/Vib.py", line 2147, in VerifySignature
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 raise err
YYYY-mm-DDTHH:MM:SS.zzzZ Er(11) lifecycle[####]: imagemanagerctl:101 vmware.esximage.Errors.VibSigInvalidError: ('##VIB_NAME##', 'Could not find a trusted signer: unable to get local issuer certificate')
Environment
VMware vSphere ESXi
Cause
This issue occurs because the VIB package is signed by a certificate authority that is not included in the ESXi’s trusted certificate store.
When vLCM stages VIB images in ESXi, it attempts to validate the chain of trust. If the root or intermediate CA certificate is untrusted by the ESXi host, the signature validation process fails with VibSigInvalidError, even if the VIB itself is not corrupted.
Resolution
Option 1 (Recommended)
Contact the third-party vendor to obtain an updated VIB bundle that is officially signed by a VMware-trusted Certificate Authority.
Option 2 (Workaround)
If the VIB is required immediately and a properly signed version is unavailable, you can bypass signature checking by installing the VIB manually.
Warning: Installing VIBs manually via CLI will cause the ESXi host to become 'Non-Compliant' in vLCM. Once an officially signed version becomes available, you may need to install the new VIB to restore vLCM compliance.
Steps:
- Upload the offline bundle (.zip) to a datastore.
- Log in to the target ESXi host via SSH as root.
- (Optional) If the VIB is categorized as CommunitySupported, lower the host's acceptance level:
esxcli software acceptance set --level CommunitySupported
- Install the VIB with the --no-sig-check flag to skip the validation processes:
esxcli software vib install -d /vmfs/volumes/[DATASTORE_NAME]/[VIB_FILE_NAME].zip --no-sig-check
- Reboot the host if required by the installation output.
Feedback
