Sphere Replication SSLHandshakeException: PKIX path building failed in Enhanced Replication mode

Products

• VMware Live Recovery

Issue/Introduction

Enhanced Replication mappings fail.Replication for the vm not active.

The Site Recovery UI and appliance logs (hms.log) report SSL trust failures despite the use of valid, CA-signed certificates. Common error signatures include:

• Connect: certificate verify failed (SSL routines)
• javax.net.ssl.SSLHandshakeException: PKIX path building failed
• Failed to connect to server <IP>:32032

Environment

VMware Live Recovery 9.0.x

Cause

The issue is caused by duplicate BIOS UUIDs across multiple ESXi hosts in the environment (frequently observed on HPE servers where serial numbers or BIOS identifiers were modified).

vSphere Replication uses the hardware BIOS UUID as a unique identifier to track host entities in its internal database (hbrserverentity table). When multiple hosts share the same UUID, the vSphere Replication appliance creates conflicting entries and caches incorrect certificate thumbprints. This leads to a mismatch where the appliance expects a thumbprint from "Host A" but receives a different one from "Host B," triggering a security rejection during the SSL handshake.

Resolution

1. Hardware Unique Identification: Modify the BIOS/Firmware settings on the physical servers to ensure every ESXi host has a unique hardware UUID.
   
    Verify the host uuid  from ESX ssh session
      # esxcli hardware platform get | grep UUID | sed -e 's/0x//g'
      UUID: ## ## ## # ## ## ## ## ## ## ## ## ## ## ## #  
   
    Now compare to the hostuuid output from the local vSphere Replication appliance  
       # /opt/vmware/hms/bin/embedded_db_connect.sh
       vrmsdb=# select vsrv_address, hostuuid  from hbrserverentity;  
   
               vsrv_address  |               hostuuid
               -------------------+--------------------------------------
               xxx.xxx.xx.xx   | ########-####-####-####-############
      
2. Service Refresh: Restart the management services on the vSphere Replication appliances to clear stale database mappings and cached thumbprints:
   • systemctl restart hms
   • systemctl restart hbrsrv
3. Host Agent Refresh: Restart the management agents on the ESXi hosts:
   • /etc/init.d/hostd restart
   • /etc/init.d/vpxa restart
4. Health Check: In the Site Recovery UI, navigate to Enhanced Replication Mappings and select Run All Tests to force a fresh thumbprint exchange between the appliances and the now-unique hosts.