vSphere HA fails to configure after replacing ESXi certificates

Products

• VMware vSphere ESXi

Issue/Introduction

• ESXi certificates replaced as custom certificates
• HA failing to configure; a primary is elected but the rest of the hosts go HAUnreachable
• /var/run/log/fdm.log on an affected host shows errors similar to:
  Error N7Vmacore3Ssl18SSLVerifyExceptionE(SSL Exception: Verification parameters:
--> PeerThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:D0
--> ExpectedThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:D7
--> ExpectedPeerName: host-###
--> The remote host certificate has these problems:
-->
--> * Host name does not match the subject name(s) in certificate.
-->* Unable to get local issuer certs
• The thumbprint of the certificate on the ESXi host doesn't match the thumbprints stored in the vCenter database (to compare, see the steps in Additional Information section)

Environment

vSphere 7.0

vSphere 8.0

Cause

The thumbprint entries in the vCenter database do not match the thumbprint of the new ESXi host certificate.

In order to configure vSphere HA, vCenter informs the hosts to expect a connection from a certain thumbprint, using it's database as the record to pull from. As the entries won't match the actual certificate thumbprint; this issue occurs. 

 

Resolution

1. Disconnect the ESXi host from vCenter - this operation does not impact running VMs. Do not remove the ESXi host from inventory. 
2. Reconnect the ESXi host to vCenter - this will force vCenter to read the new certificate ESXi has and update the database.

Additional Information

To compare the thumbprint of the ESXi certificate with the thumbprints in the vCenter database:

1. Select the ESXi host in the vCenter UI and note the host ID from the URL bar - the numeric portion from the format: host-###
2. On an SSH to the ESXi host, run the following command:
   openssl x509 -in /etc/vmware/ssl/rui.crt -noout -fingerprint
3. On an SSH to the vCenter, run the following command:
   /opt/vmware/vpostgres/current/bin/psql -d VCDB -U postgres -c "select id,dns_name,expected_ssl_thumbprint,host_ssl_thumbprint from vpx_host where id = <host_id_from_step_1>;"