vCenter displays "no healthy stream" in Certificate Management for Machine SSL while SDDC Manager shows valid certificates in VCF

Products

• VMware vCenter Server
• VMware SDDC Manager / VCF Installer

Issue/Introduction

• vCenter Certificate Management UI shows "no healthy stream" for the Machine SSL certificate.
  
  
  
  
• SDDC Manager Certificate Management dashboard indicates all certificates are "Valid".
  
  
• All the vCenter services are running, restarting the vCenter services does not resolve the issue.  

Environment

VMware vCenter 8.x
VMware Cloud Foundation (VCF) 5.x

Cause

This condition occurs when vCenter certificates are renewed out-of-band (manually on the vCenter appliance) rather than through the SDDC Manager. This creates a synchronization failure where the SDDC Manager database does not match the actual certificate thumbprints or status on the vCenter Server, breaking the management trust.

Resolution

Follow these steps to resolve the issue.

Workaround

Perform this workaround to address potential trust issues between vCenter and SDDC Manager:

1. Log in to the management vCenter.
2. Navigate to Administration > Client Plugins.
3. Select SDDC Manager and remove it.
4. SSH to the SDDC Manager appliance.
5. Restart the UI service by running the following command: systemctl restart sddc-manager-ui-app
6. Allow 3 to 5 minutes for the process to complete. This will restore the SDDC Manager Remote Plugin in vCenter Server with the updated certificate.

If the issue persists, complete the automated certificate renewal:

Resolution:

1. Log in to the SDDC Manager UI.
2. Navigate to Inventory > Workload Domains.
3. Select the affected domain and click the Certificates tab.
4. Select the vCenter Server component and click Renew Certificates.
5. Follow the prompts to complete the renewal.
6. Once the vCenter certificates are updated, navigate to Administration > Certificate Management.
7. Select the SDDC_MANAGER component and click Renew Certificates.
8. Verify that the "no healthy stream" warning is cleared in the Machine SSL > Certificate Management tab of vCenter.