VCF Operations UI fails to display Password or Certificate information under Fleet Management

Products

• VCF Operations

Issue/Introduction

• When navigating to Fleet Management > Password or Certificates in the VCF Operations UI, no credential or certificate data is displayed for the SDDC Instance.

• The underlying credentials and certificates remain visible and valid within the SDDC Manager UI and CLI, but they fail to synchronize with the VCF Operations UI.
  
  

• Logs on the associated Cloud Proxy VM located at /log/adapters/ManagementAdapter/ManagementAdapter_XXXXXX.log show the following verification failure:

Exception occurred in credentials collection. org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://<SDDC_Manager_IP>/v1/credentials/ui": Host name '<SDDC_Manager_IP>' does not match the certificate subject provided by the peer (EMAILADDRESS=..., CN=<SDDC_Manager_FQDN>, OU=..., O=..., L=..., ST=..., C=...); nested exception is javax.net.ssl.SSLPeerUnverifiedException: Host name '<SDDC_Manager_IP>' does not match the certificate subject provided by the peer

Environment

VCF 9.0
VCF Operations 9.0

Cause

This issue occurs because the VCF Operations SDDC Instance adapter is configured to connect to the SDDC Manager using its IP address instead of its Fully Qualified Domain Name.

When the adapter initiates a REST API request to collect credentials, standard SSL certificate validation requires the requested endpoint to match the Common Name (CN) or a Subject Alternative Name (SAN) on the target server's certificate.

As shown in the logs, the certificate presented by the SDDC Manager is issued to its FQDN (CN=<SDDC_Manager_FQDN>). Because the adapter is attempting to connect via the IP address—which is not listed as a valid subject on the certificate—the strict SSL verification rejects the connection and throws an SSLPeerUnverifiedException. This aborts the credential collection process.

Resolution

To resolve this issue, you must update the adapter configuration to use the FQDN, aligning the hostname with the certificate subject.

1. Reconfigure the VCF Operations SDDC Instance adapter settings to target the SDDC Manager using its Fully Qualified Domain Name (FQDN) instead of the IP address.

2. Once this change is made, duplicate objects will appear under the VCF Adapter instance. To resolve the duplicate objects, follow these steps in the VCF Operations UI:

   • Navigate to Infrastructure Operations > Configurations > Inventory Management > Adapter Instances > VMware Cloud Foundation.

   • Select the corresponding VCF Adapter Instance.

   • Review the collection status to identify the stale adapter (the one using the IP address).

   • Select and Delete the stale adapter. Note that you’ll lose the historical data for these objects.

   • Select the respective adapter and click on Start Maintenance from the toolbar, followed by End Maintenance.

Following this change, the SSL handshake will succeed, and the certificates and passwords will successfully display in the VCF Operations UI.