Login into VCF Operations failed with error unable to find valid certification path

Products

• VCF Operations

Issue/Introduction

Logins to VMware Cloud Foundation (VCF) Operations using Single Sign-On (SSO) are unsuccessful. The VCF SSO is successfully configured for vCenter and NSX (with an embedded vIDB), and SSO access to these components functions as expected.

The following errors are observed in /storage/log/vcfops/log/vcops-bridge.log

####-##-##T08: 54:29.229Z ERROR analytics 24214 [ops@4413 threadId="7001168" threadName="ServerConnection on port 10000 Thread 46"] [com. vmware. vcops . auth. vidb. VidbSearchHelper . searchVidbUserGroups] - Group search in vIDB failed.
com. vmware. vrops . vidb. client . exception. VidbClientCertificateException: javax. net . ssl. SSLHandshakeException: PKIX path building failed: sun. security.provider . certpath. SunCertPathBuilderException: unable to find valid certification path

In storage/vcops/log/analytics-x.log

####-##-##T08:56:34.209Z ERROR analytics 24214 [ops@4413 threadId="8265230" threadName="DistTaskvIDB Full Sync"] [com. vmware. vrops. vidb. client. VidbClient. getAccessTokenByClientCredentials] Failed to fetch token by client credentials.

Environment

VMware vSphere Foundation 9.x
VCF Operations 9.x

Cause

A certificate trust issue exists between the VCF Operations appliance and the embedded vIDB. The VCF Operations appliance is unable to validate the certification path to the requested target, resulting in an SSL handshake failure when attempting to query groups or fetch access tokens.

Resolution

To resolve this issue, one of the following two options must be utilized to refresh the certificate trust.

Option 1: Toggle the SSO Configuration via the UI

1. Log into the VCF Operations UI using a local administrative account.

2. Navigate to Fleet > Identity access > operations appliance.

3. Disable SSO for the operations appliance.

4. Re-enable SSO for the operations appliance. Note: This action will not impact the vCenter SSO configuration.

5. Import the necessary User(s) to restore access.

Option 2: Reboot the Appliance Perform a guest operating system restart of the VCF Operations appliance. Refer to the official product documentation for instructions on shutting down and starting VCF Operations safely.