Error: "Certificate Chain is not complete" when replacing VMCA as a subordinate CA in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• When replacing VMCA as a suboridinate CA in vCenter Server either using Certificate-Manager or vCert, the certificate replacement operation fails with following error:
  Error Code : 70062
Error Message : Certificate Chain is not complete
  
  
• Reviewing /var/log/vmware/vmcad/certificate-manager.log on the vCenter Server:
  YYYY-MM-DDT:DD:HH:SS INFO certificate-manager  Replacing Root Cert using Custom CA...
YYYY-MM-DDT:DD:HH:SS INFO certificate-manager  Running command :- ['/usr/lib/vmware-vmca/bin/certool', '--rootca', '--cert', '/root/vmca/chain.cer', '--privkey', '/root/vmca/vmca_issued_key.key', '--server', 'localhost']
YYYY-MM-DDT:DD:HH:SS INFO certificate-manager  Command output :-
Status : Failed
Error Code : 70062
Error Message : Certificate Chain is not complete
YYYY-MM-DDT:DD:HH:SS ERROR certificate-manager  Status : Failed
Error Code : 70062
Error Message : Certificate Chain is not complete
YYYY-MM-DDT:DD:HH:SS ERROR certificate-manager  Error while performing Cert Replacement operation, please see /var/log/vmware/vmcad/certificate-manager.log for more information.
YYYY-MM-DDT:DD:HH:SS ERROR certificate-manager  {
    "detail": [
        {
            "id": "install.ciscommon.command.errinvoke",
            "translatable": "An error occurred while invoking external command : '%(0)s'",
            "args": [
                "Status : Failed\nError Code : 70062\nError Message : Certificate Chain is not complete\n"
            ],
            "localized": "An error occurred while invoking external command : 'Status : Failed\nError Code : 70062\nError Message : Certificate Chain is not complete\n'"
        },
        "Error while performing certool rootca command"
    ],
    "componentKey": null,
    "problemId": null,
    "resolution": null
}

Environment

vCenter Server 8.x

Cause

This is due to an invalid certificate chain, likely caused by a missing or incorrect intermediate or root certificate.

Resolution

1. Create a valid certificate chain in the following order and save it as chain.cer. Ensure there are no trailing spaces or extraneous characters outside the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers in the certificate file.
   1. Signed VMCA certificate.
   2. Intermediate certificate (if applicable).
   3. Root certificate.
      
      
2. Configure VMCA as an Intermediate CA using Certificate-Manager or vCert and provide the full paths to both the chain.cer and vmca_issued_key.key files.