Could not establish retrust due to: Retrust with <VMware Aria Operations for Logs FQDN> failed error when replacing vCenter Certificates within SDDC.

Products

• VMware SDDC Manager / VCF Installer
• VMware vRealize Log Insight 8.x
• VMware Aria Operations (formerly vRealize Operations) 8.x

Issue/Introduction

• During a vCenter Server certificate replacement workflow in SDDC Manager, the task completes then reverts to failed approximately 5 minutes after completion. 
• Certificate is already replaced at the point of failure when directly accessing vCenter.
• The SDDC Manager UI still displays a failure on the certificate replacement task.
• Gui error presented on failed task within SDDC states : Could not establish retrust due to: Retrust with <VMware Aria Operations for Logs FQDN> failed, with error VO error on POST request for "https://<VMware Aria Operations for Logs  FQDN>:9543,lapi/v1/sessions *: Certificate for <VRLI FQDN> doesn't match any of the subject alternative names: [].

Environment

• VMware Cloud Foundation 
• VMware Aria Operations for Logs (formerly VMware vRealize Log Insight or vRLI)

Cause

The SSL certificate assigned to VMware Aria Operations for Logs lacks a Subject Alternative Name (SAN). SDDC Manager suite trust validation requires valid SAN attributes on all integrated component certificates to establish secure communications. When attempting to retrust the vCenter certificate, SDDC is unable to communicate with VMware Aria Operations for Logs and presents this error. Although the cert has been replaced in VC, it has not been re-trusted within Aria Operations for Logs.

Resolution

To resolve this issue, generate and deploy a SAN-enabled SSL certificate.

1. Take a snapshot of vRLI and vRSLCM
2. Verify that the hostnames on all 3 vRLI nodes are set to the FQDN. You can do this by running the following command on each node: hostname. If the hostname does not show the FQDN, set it to the FQDN by running this command: hostname <FQDN>
3. Configure a certificate by following the steps here: Configure certificate details. Ensure that the Subject Alternative Names include the FQDNs and IPs for the vRLI VIP and all 3 vRLI nodes.
4. Assign the new certificate by following the steps here: Manage certificates for VMware Aria Suite Lifecycle products
5. Run an inventory sync for vRLI by following the steps here: Inventory synchronization in VMware Aria Suite Lifecycle
6. Reattempt the certificate replacement workflow from SDDC Manager

Additional Information

The same issue can occur for password management tasks as documented in the following KB - Password Management operations fail for Aria Operations and Aria Operations for Logs (Formerly VRLI)