vCenter Certificate Management UI fails with "VMCA_ROOT_CA_MISSING" due to VCHA issues

Products

• VMware vCenter Server 8.0

Issue/Introduction

Symptoms:

• Accessing the "Trusted Root" section in vCenter 8.x Certificate Management fails with an error "Error occurred while fetching vmca root cert: Internal Server Error (Error occurred while getting certificate VMCA_ROOT_CA_MISSING)".
• The vCenter vsphere_client.virgo.log has the example error below

[YYYY-MM-DDTHH:MM:SS] [ERROR] -nio-127.0.0.1-5090-exec-695 xxxxxx c.vmware.certificates.client.controllers.VcCertificateController  Internal server error occurred while accessing Certificate services:  com.vmware.vapi.std.errors.Error: Error (com.vmware.vapi.std.errors.error) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = com.vmware.certificateauthority.error,
    defaultMessage = Internal Server Error (Error occurred while getting certificate VMCA_ROOT_CA_MISSING),
    args = [Error occurred while getting certificate VMCA_ROOT_CA_MISSING]

• vCenter High Availability (VCHA) is in a bad state and there is error "vCenter HA has an invalid configuration" when a user accesses the "vCenter HA" section.
• This may occur if previous certificate operations, such as replacing the vCenter certificate with an Enterprise CA signed certificate, were attempted..

Environment

VMware vCenter Server 8

Cause

The certificatemanagement-svcs encounters a VMCAException because the VCHA cluster state interferes with the service's ability to query the local VMCA root.

As per KB https://knowledge.broadcom.com/external/article/403973/vcenter-machine-ssl-certificate-replacem.html, the VCHA needs to be disabled before rotating certificate.

Resolution

 

• Identify whether VCHA is in a "invalid configuration" state via the vCenter UI.
• If the standard "REMOVE VCENTER HA" button fails, then check and follow KB 393136 to manually remove the VCHA configuration.
• Reboot the vCenter.
• Re-attempt access to the Certificate Management UI.

 

Additional Information

Disable VCHA before rotating certificate:

KB https://knowledge.broadcom.com/external/article/403973/vcenter-machine-ssl-certificate-replacem.html

Remove VCHA:

KB https://knowledge.broadcom.com/external/article/393136/remove-vcenterha-option-fails-with-gener.html