Error "Exception occured in postinstallHook for soluser.Patch" while patching vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• The vCenter Server patching operation fails with the error "Exception occured in postinstallHook for soluser.Patch. Please check the logs for more details. Take corrective action and then resume."




• On the /var/log/vmware/applmgmt/PatchRunner.log:
  

  "translatable": "An error occurred while invoking external command : '%(0)s'",
"args": [
"Command: ['/usr/lib/vmware-vmca/bin/certool', '--server=#_Old_FQDN]', '--genCIScert', '--privkey=/etc/certs/machine/machine.priv', '--cert=/etc/certs/machine/machine.crt', '--Name=machine', '--FQDN=[#_New_FQDN]']\n
Stderr: "],
"localized": "An error occurred while invoking external command : 'Command: ['/usr/lib/vmware-vmca/bin/certool', '--server=#_Old_FQDN]', '--genCIScert', '--privkey=/etc/certs/machine/machine.priv', '--cert=/etc/certs/machine/mach
ine.crt', '--Name=machine', '--FQDN=[#_New_FQDN]']\nStderr: '"
},
{
"id": "install.ciscommon.vmca.appendtocert",
"translatable": "Error in appending hostname/ip %(0)s to Cert.",
"args": [
"[#_New_FQDN]"
],
"localized": "Error in appending hostname/ip [#_New_FQDN] to Cert."
}
],
"componentKey": null,
"problemId": null,
"resolution": null
}
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/libs/sdk/extensions.py", line 123, in _func
return func(*args)
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/payload/components-script/soluser/init.py", line 104, in patch
_checkAndRenewSolutionUserCertificates(ctx)
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/payload/components-script/soluser/init.py", line 161, in _checkAndRenewSolutionUserCertificates
raise e
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/payload/components-script/soluser/init.py", line 158, in _checkAndRenewSolutionUserCertificates
renewSolutionUserCertificates()
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/payload/components-script/soluser/init.py", line 177, in renewSolutionUserCertificates
solUser._cleanup()
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/payload/components-script/soluser/utils.py", line 72, in _cleanup
tempFiles = [self._private_key_path, self._public_key_path, self._cert_path, self._pfx_path]
AttributeError: 'SolutionUser' object has no attribute '_private_key_path'
YYYY-MM-DDTHH:MM:SS.MS+HH:MM ERROR vmware_b2b.patching.phases.patcher Patch hook Patch got ComponentWrapperError.
Traceback (most recent call last):
...............
File "/storage/updatemgr/software-update2a_r2sbs/stage/scripts/patches/py/vmware_b2b/patching/executor/hook_executor_process.py", line 119, in executeHook
raise ex
patch_errors.ComponentError
YYYY-MM-DDTHH:MM:SS.MS+HH:MM WARNING root stopping status aggregation...
YYYY-MM-DDTHH:MM:SS.MS+HH:MM ERROR main Patch vCSA failed

 

Environment

vCenter Server 8.x

Cause

This issue occurs due to legacy certificate metadata referencing a decommissioned domain or hostname stored in the VMware Directory Service (VMDIR). During the patching process, the soluser.Patch hook attempts to validate certificates against the current Fully Qualified Domain Name (FQDN). The certool utility fails when encountering the mismatch between the legacy domain metadata stored in VMDIR and the active environment settings, resulting in an interruption of the patch installation.

Resolution

Prerequisites

• Take an offline (cold) snapshot of the vCenter Server Appliance before proceeding Best practices for using VMware snapshots in the vSphere environment

Step 1: Clean Stale Entries Use the vCert utility to identify and remove stale certificate entries within the VMware Directory Service.

1. Download the vCert utility.
2. Execute the vCert script and use the management options to remove stale/expired certificate entries associated with the legacy FQDN. vCert - Scripted vCenter expired certificate replacement

Step 2: Repair Solution User Certificates Use the lsdoctor tool Using the 'lsdoctor' Tool to validate the health of the Single Sign-On (SSO) environment and recreate affected solution user certificates.

1. Log in to the vCenter Server Appliance via SSH as the root user.
2. Run the lsdoctor utility with the update flag to repair the solution user certificates: python lsdoctor.py -u
3. The tool will automatically recreate the necessary service identities (including vpxd, machine, vsphere-webclient, hvc, and wcp).

Step 3: Regenerate Machine Certificates Ensure the machine certificates align with the current environment FQDN.

1. Using the vCert utility, perform a regeneration of the machine certificates.
2. Verify that all certificate attributes (FQDN and Subject Alternative Name) strictly match the current FQDN.

Step 4: Resume Patching 

1. Restart all the services of the vCenter Server: service-control --stop --all && service-control --start --all
2. Navigate to the VAMI interface (Update > Install) and resume the patching process. 

Additional Information

Patching/Updating vCenter Server through vCenter Server Appliance Management Interface (VAMI)