Scheduled and Manual Backups Fail in vCenter Server Management with "[SSL: CERTIFICATE_VERIFY_FAILED]" Error

Products

• VMware vCenter Server

Issue/Introduction

This article addresses an issue where both scheduled and manual backups initiated via the vCenter Server Management (VAMI) interface fail with an SSL certificate verification error. The VAMI page may also return a 503 error, and the applmgmt service fails to start.

Error Message:

[MainProcess:PID-#######] [BackupManager::main:BackupManager.py:645] ERROR: BackupManager encountered an exception: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1007)

Environment

VMware vCenter Server

Cause

The issue is caused by expired CA certificates within the VMware Directory Service (vmdir). While the machine SSL certificate itself may appear valid, the expiration of the vmdir CA certificates prevents the applmgmt service from initializing properly, resulting in 503 errors and the failure of all backup operations (scheduled and manual).

Resolution

To restore functionality, the expired CA certificates within vmdir must be replaced to restore the correct certificate chain.

1. Prerequisites:

   • Take a snapshot or backup of the vCenter Server appliance before making any changes to certificate stores.
   • Ensure you have root access to the vCenter Server appliance via SSH.

2. Replacement Steps:

   • Log in to the vCenter Server via SSH as root.
   • Use the vCert tool to inspect and identify the expired CA certificates within the vmdir.
   • Replace the expired CA certificates. (Note: Refer to the specific version-appropriate documentation for your deployment, such as the vSphere Certificate Management tools, to perform the renewal or replacement of vmdir CA certificates.). Machine SSL certificate renewal using Custom Certificate Authority (CA) in vCenter Server
   • Once the certificates are replaced, restart the applmgmt service:

     service-control --restart applmgmt

   • Verify that the VAMI interface is accessible and that both manual and scheduled backups complete successfully.

Additional Information

Attempting to access the vCenter Appliance Management Interface results in a 503 - OK Error (Service Unavailable), indicating that the service is currently unavailable.