"Error trying to establish connection" when validating vCenter Server connection

Products

VCF Operations VMware vCenter Server

Issue/Introduction

VCF Operations loses connectivity with a vCenter Server in a VMware Cloud Foundation (VCF) environment. This issue displays the following symptoms:

Data Collection Failure: Metrics and monitoring data for the target vCenter Server do not update in VCF Operations.
Licensing Alerts: The vCenter Server displays as NOT_LICENSE_MANAGED_VCENTER in Licensing Management, which triggers license compliance alerts.
Validation Error: VCF Operations reports the error "Error trying to establish connection" when running Validate Connection against the vCenter Server.

Log Findings

The VCF Operations adapter log (/storage/log/vcops/log/adapters/VMwareAdapter/VMwareAdapter_####.log) displays SSL handshake exceptions:

com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: PKIX path building failed
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target java.lang.ClassCastException: class java.security.cert.PKIXReason cannot be cast to class java.security.cert.CertPathValidatorException$BasicReason

The Analytics service log (/storage/log/vcops/log/analytics-####.log) displays:

[com.vmware.vcops.auth.task.VcDomainDataRefreshServer.getDomainsMap] - Exception while getting domainlist from vc: https://vcenter.example.com/sdk message: Exception while getting userDirectory, reason: Connecting to VC at https://vcenter.example.com/sdk failed.

Environment

VCF Operations 9.x

vCenter Server 9.x

Cause

The SSL/TLS certificate of the target vCenter Server changes or renews, but the updated certificate or its issuing Certificate Authority (CA) chain does not exist in the VCF Operations Trusted Certificate store. The resulting broken trust relationship causes VCF Operations to terminate the connection during the SSL handshake, resulting in failures in both the Management Adapter and the VMware Adapter.

Resolution

Import the updated vCenter Server certificate into the VCF Operations trust store to restore connectivity:

Export the vCenter Server Certificate:

1. Navigate to the vCenter Server FQDN in a web browser.
2. Select the lock icon in the address bar to view the certificate details.
3. Export the leaf server certificate as a Base64-encoded ASCII (.pem or .crt) file.
  
  Note: Ensure Root and Intermediate CA certificates are available and imported into the trust store if using a custom CA.
Import the Certificate:
1. Log in to the VCF Operations UI as an administrator.
2. Navigate to Administration > Control Panel.
3. Select Trusted Certificates and click Import.
4. Upload the certificate file exported in Step 1.
5. Review the certificate information and click Import to add it to the trust store.
Revalidate the Connection:
1. Navigate to Integrations > Accounts.
2. Locate the vCenter adapter instance for the affected vCenter Server.
3. Select Edit, and click Validate Connection.
4. Accept the certificate if prompted and click Save.
Verification:
1. Confirm Validate Connection returns a success status in the UI.
2. Verify data collection status changes to Receiving Data within 5–10 minutes.
3. Verify the vCenter Server status in Licensing Management returns to a normal managed state.