Error: vSphere SHA-1 validation failed during SDDC Manager upgrade precheck of vCenter in VCF 5.2.4

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• SDDC Manager precheck for vCenter upgrade is failing with a “vSphere SHA-1 validation” error.

ERROR vSphere SHA-1 validation failed

High: Do not perform upgrade without addressing this issue.

Check the /var/log/vmware/vcf/operationsmanager/assessment/pythonvalidations/########-####-####-############/artifacts/vsphere-sha1-validation-execution-error-########-####-####-############.txt file for more details.

• It has been confirmed that there are no SHA-1 certificates on the vCenter using this article
• Running the command below on SDDC Manager (ssh as vcf, su) returns the error below:

/usr/lib/vmware-vmafd/bin/vecs-cli force-refresh --server vcenter_fqdn --upn [email protected]

vecs-cli failed. Error 382312513: Failed to connect to the remote host, reason = rpc_s_connect_timed_out (0x16c9a041).

Environment

VCF 5.2.4

Cause

• TCP port 2020 inbound on the vCenter is blocked for traffic coming from SDDC Manager.
• Per https://ports.broadcom.com, TCP port 2020 is used as an RPC port for VMware Endpoint Certificate Store (VMAFD) API access.
• In SDDC Manager 5.2.4 vecs-cli is now available on the SDDC Manager and is used in the precheck to query the VECS store on the vCenter.
• Traffic blockage on port 2020 prevents VECS validation, mimicking a SHA-1 error.

Resolution

1. Ensure that TCP port 2020 inbound on the vCenter is accessible from the SDDC Manager.
2. This ensures that the SDDC Manager precheck (which needs to use TCP port 2020) can run the VMware Endpoint Certificate Store (VMAFD) API call.