vSphere HA configuration fails due to SSL certificate thumbprint mismatch

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• When attempting to enable vSphere HA, the configuration fails, and the ESXi host repeatedly disconnects and reconnects.
• The vSphere logs indicate an SSL certificate thumbprint mismatch between the vCenter Server and the ESXi host.
• The FDM logs on the ESXi show the errors below:

/var/run/log/fdm.log:

YYYY-MM-DDTHH:MM warning fdm[#####] [Originator@### sub=Cluster opID=SWI-#####] Failed to verify host (###.###.###.###) - closing connection
YYYY-MM-DDTHH:MM verbose fdm[####] [Originator@### sub=Message opID=SWI-#####] Accept completion callback error N5Vmomi5Fault13SecurityError9ExceptionE(Fault cause: vmodl.fault.SecurityError--> )
YYYY-MM-DDTHH:MM:SS.###Z Db (##) Fdm[#####]: [Originator@### sub=Cluster opID=WorkQueue-######] IP ###.###.###.### marked bad for reason Unreachable IP
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: [Originator@### sub=IO.Connection opID=WorkQueue-####] Failed to SSL handshake; SSL(<io_obj p:0x000000######, h:#<TCP '###.###.###.###:8182'>>), e:###### (certificate verify failed (SSL routines) ),duration: #msec
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: [Originator@### sub=Message opID=WorkQueue-####] Error N7Vmacore3Ss118SSLVerifyExceptionE (SSL Exception: Verification
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: -- > PeerThumbprint: 3F:##:##:##:##:##:##:##:##:##:##:##:DA:##:##:##:##:##:##:##:##:##:##:BB
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: -- > ExpectedThumbprint: FF:##:##:##:##:##:##:##:##:##:##:2B:##:##:##:##:##:##:##:##:##:##:##:AC
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: -- > ExpectedPeerName: ########
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: -- > The remote host certificate has these problems:
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: -- >
YYYY-MM-DDTHH:MM:SS.###Z Er (##) Fdm[#####]: -- > * Host name does not match the subject name (s) in certificate.)

Environment

• VMware vCenter Server 8.0.x
• VMware vSphere ESXi 8.0.x

Cause

A mismatch between the host SSL certificate thumbprint and the expected value stored in the vCenter Database (VCDB) typically occurs after a certificate replacement, preventing the vCenter Server from validating the host's identity during HA initialization.

Resolution

Regenerate the host certificates to resolve the thumbprint discrepancy.

1. In the vCenter Server inventory, right-click the impacted ESXi host and select Connection > Disconnect.
2. Connect to the impacted ESXi host via SSH.
3. Navigate to the SSL directory:
   cd /etc/vmware/ssl/
4. Rename the existing certificate and key files:
   mv rui.crt rui.crt.old
mv rui.key rui.key.old
5. Generate new certificates:
   /sbin/generate-certificates
6. Reboot the host for the changes to take effect.
7. Once the host reboots, return to the vCenter Server inventory, right-click the host, and select Connection > Connect.

Additional Information

If the issue persists, the thumbprint might still need synchronization in the VCDB. For further assistance, contact Broadcom Support.