During the vCenter brownfield import or workload domain pre-check in VCF 9.x, the process fails with a reported SSH error.

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• The VCF Operations UI displays the error: `SSH login is disabled on vCenter for <vCenter-FQDN>
• SSH is confirmed to be enabled and accessible via manual connection
• vCenter applmgmt.log present at /var/log/vmware/applmgmt shows following error :
  
  YYYY-MM-DDTHH:MM:SS PM +03 [8769]ERROR:vmware.appliance.vapi.auth:Could not parse HOK Token
Traceback (most recent call last):
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 507, in validate
    self.validate_certificate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 709, in validate_certificate
    raise AuthenticationError(
  vmware.appliance.extensions.authentication.authentication_sso.AuthenticationError: One or more certificates cannot be verified.
   
• During handling of the above exception, another exception occurred:
  
  Traceback (most recent call last):
  File "/usr/lib/applmgmt/vapi/py/vmware/appliance/vapi/auth.py", line 252, in authenticate
    username = token.username
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 487, in username
    return self.get_name_id().value
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 983, in get_name_id
    '//saml2:Subject/saml2:NameID', self.reference)
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 478, in reference
    self.validate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 1213, in validate
    reference = super(HolderOfKeyToken, self).validate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 509, in validate
    self.validate_certificate()
  File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 709, in validate_certificate
    raise AuthenticationError(
  vmware.appliance.extensions.authentication.authentication_sso.AuthenticationError: One or more certificates cannot be verified.
  
  
  
• We see the following in the audit logs present at /var/log/audit :
  
  
  YYYY-MM-DDTHH:MM:SS.976: INFO Authorization Result: User=root, priv=ViewConfiguration, authorized=True
  YYYY-MM-DDTHH:MM:SS:55.719: ERROR Authentication Status : Failed
YYYY-MM-DDTHH:MM:SS.719: ERROR Authentication Status : Failed
YYYY-MM-DDTHH:MM:SS.719: ERROR Authentication Status : Failed
YYYY-MM-DDTHH:MM:SS.719: ERROR Authentication Status : Failed
YYYY-MM-DDTHH:MM:SS.720: ERROR Authentication Status : Failed
YYYY-MM-DDTHH:MM:SS.719: ERROR Authentication Status : Failed
YYYY-MM-DDTHH:MM:SS.718: ERROR Authentication Status : Failed

 

Environment

VMware Cloud Foundation 9.x

VMware vCenter Server 8.x / 9.x

VCF Operations 9.x

Cause

The Security Token Service (STS) certificate chain is incomplete (partial chain). This prevents the applmgmt service from validating the Holder-of-Key (HOK) token during the Single Sign-On (SSO) authentication process required for the VCF import workflow.

Resolution

Renew the STS certificate ensuring the full certificate chain is included.

Refer to vCert Utility (KB 385107) for automated replacement steps.