ESXi host patching fails with 'Incompatible' state in vSphere Lifecycle Manager (vLCM) due to HSM using SHA-certificate

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

ESXi host patching or remediation fails when using image-based updates in vSphere Lifecycle Manager (vLCM) when using a Hardware Support Manager (HSM).

The following symptoms may be observed:

• Multiple hosts show as 'Not Compatible' during vLCM compliance checks.
• In addition with the incompatibility message, an error banner is shown, stating:
  
  SHA-1 signature found in host certificate False. Support for certificates with weak signature algorithm SHA-1 has been removed in ESXi 8.0. To proceed with upgrade, replace it with a SHA-2 signature based certificate. Refer to release notes and KB 8924 for more details.
  
  
  
  
• Remediate tasks fail with the error: com.vmware.vcIntegrity.lifecycle.RemediateClusterTask.IncompatibleHosts.
• Tasks remain stuck or return to an incompatible state after clicking 'Pre-check compliance'.
• When reviewing the /var/log/vmware/vmware-updatemgr/vum-server/vmware-vum-server.log, entries like the follow one are found:

  Result from call is: { "id": "com.vmware.vcIntegrity.hcl.report.unknownDevice.summary", "translatable": "Could not determine the device's compatibility because it was not found in the VMware Compatibility Guide..." }

• The hsm-service.log, found in the same location, holds messages like:

  [ERROR] Error during SSL Handshake with remote server
  [ERROR] Got http response status code: 500

Environment

• VMware vCenter Server 9.x, 8.x
• VMware vSphere ESXi 8.x
• vSphere Lifecycle Manager (vLCM) with Image-based management
• Third-party Hardware Support Manager (HSM)

Cause

• The Hardware Support Manager (HSM) is not transmitting host hardware information to vCenter. This has been reported when the HSM was presenting an expired or unsupported (SHA-1) SSL certificate to the vCenter server, thus preventing a successful SSL handshake with the latter.

Resolution

To resolve this issue:

1. Verify the status of the Hardware Support Manager (HSM) plugin and ensure the service is running.
2. Check the HSM server SSL certificate for expiration.
3. Ensure the HSM certificate uses a supported encryption method; replace SHA-1 certificates if found.
4. Validate network connectivity between the vCenter Server and the HSM IP address/FQDN on port 443.
5. Confirm the hardware devices are listed in the Broadcom Compatibility Guide.
6. If the certificate is valid and connectivity is confirmed, engage the hardware vendor to investigate within the HSM plugin and the actual HSM appliance.

Note: In some cases the HSM for the vCenter plugin will need to be reinstalled, Firmware and Driver Addon removed and re-inserted

Additional Information

For further guidance on managing support cases, see Creating and Managing Broadcom Support Cases.