Scaleup Operation Fails for VCF Operation with SSLPeerUnverifiedException

Products

• VCF Operations

Issue/Introduction

A scale-up operation for VMware Cloud Foundation (VCF) Operations fails, returning the following error message in the task:

Failed to initiate cluster state change to 'OFFLINE' for VCF Operations '<HOSTNAME>'. Check SDDC lifecycle logs for details.

SDDC pod log reveals SSL/TLS handshake failures and peer verification exceptions:

SSL/TLS handshake failure for POST https://<HOSTNAME>/suite-api/api/auth/token/acquire:
Hostname <HOSTNAME> not verified:
Request failed after 53ms: POST https://<HOSTNAME>:443/casa/authorize
javax.net.ssl.SSLPeerUnverifiedException: Certificate for <<HOSTNAME>> doesn't match any of the subject alternative names: [localhost, <HOSTNAME>]

Environment

VMware Cloud Foundation 9.1
VCF Operations 9.1

Cause

The VCF Operations node Fully Qualified Domain Name (FQDN) was recently modified, but the SSL certificate was not updated to reflect the new Subject Alternative Names (SAN). This discrepancy causes a TLS handshake failure when SDDC Manager attempts to authenticate with the VCF Operations instance during the scale-up workflow.

Resolution

 

To fix the issue please follow the below steps.

• Generate a new Certificate Signing Request (CSR) that includes the updated FQDNs in the Subject Alternative Name (SAN) field.

• Renew and apply the SSL certificate for the VCF Operations cluster.

• For exact steps on renewing the certificate, refer to the documentation linked in the Additional Information section.

• Once the certificate successfully reflects the correct hostnames, retry the VCF Operations scale-up operation from the VCF Operations UI.

 

Additional Information

Configure a Certificate For Use With VCF Operations