Trying to configure Backup schedule for VCF Component fails with error "Failed to fetch SSH fingerprint"

Products

• VCF Operations

Issue/Introduction

• Configuring the File-Based Backup and Recovery schedule for VCF Components fails with below error:
  
  Failed to fetch SSH fingerprint. Failed to retrieve SSH thumbprint for 'SFTP-SERVER-IP/FQDN'. Verify SSH connectivity to 'SFTP-SERVER-IP/FQDN' from Fleet lifecycle.


• Verifying the port 22 connectivity from VCF Service Runtime Nodes to the SFTP server fails.
  
  curl -v telnet://<SFTP-SERVER-IP/FQDN>:22
connect to SFTP-SERVER-IP/FQDN port 22 from VCF-Service-Runtime-Node port 41014 failed: Connection refused
Failed to connect to SFTP-SERVER-IP/FQDN port 22 after 0 ms: Could not connect to server
* closing connection #0


• The VCF-Fleet-LCM build service pod logs reports below error:
  
  

   INFO  Fleet Build 44 [lcm@4413 scPath="ops" thread="pool-7-thread-3" logger="c.b.v.l.f.b.s.NetworkServiceImpl" method="getSshThumbprint:L"] [] - Getting SSH thumbprint for server class ServerAddress {
  stdout F     address: SFTP-Server-IP/FQDN
  stdout F     port: 22
  stdout F }
  stdout F 2026-07-31T03:44:52.283Z INFO  Fleet Build 44 [lcm@4413 scPath="ops" thread="pool-7-thread-3" logger="c.b.v.l.s.b.p.common.util.SshKeyUtil" method="getSshThumbprints:L"] [] - Getting SSH fingerprint for host: SFTP-Server-IP/FQDN:22
  ERROR Fleet Build 44 [lcm@4413 scPath="ops" thread="pool-7-thread-3" logger="c.b.v.l.f.b.s.NetworkServiceImpl" method="getSshThumbprint:L"] [] - Thumbprint request could not be created
  stdout F com.broadcom.vcf.lcm.sddc.build.plugins.common.model.SshClientException: SFTP-Server-IP/FQDN: Failed to get SSH fingerprint:
  stdout F         at com.broadcom.vcf.lcm.sddc.build.plugins.common.util.SshKeyUtil.getSshThumbprints(SshKeyUtil.java:102)
  stdout F         at com.broadcom.vcf.lcm.sddc.build.plugins.common.util.SshKeyUtil.getSshThumbprints(SshKeyUtil.java:57)
  stdout F         at com.broadcom.vcf.lcm.fleet.build.service.NetworkServiceImpl.getSshThumbprint(NetworkServiceImpl.java:149)
  stdout F         at com.broadcom.vcf.lcm.fleet.build.service.NetworkServiceImpl.lambda$getAddressAttributes$1(NetworkServiceImpl.java:89)
  stdout F         at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(Unknown Source)
  stdout F         at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  stdout F         at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  stdout F         at java.base/java.lang.Thread.run(Unknown Source)
  stdout F Caused by: org.apache.sshd.common.SshException: DefaultConnectFuture[########-####-####-####-############@/SFTP-Server-IP/FQDN:22]: Failed (ConnectException) to execute: Connection refused
  stdout F         at org.apache.sshd.common.future.AbstractSshFuture.lambda$verifyResult$2(AbstractSshFuture.java:146)
  stdout F         at org.apache.sshd.common.future.AbstractSshFuture.formatExceptionMessage(AbstractSshFuture.java:206)
  stdout F         at org.apache.sshd.common.future.AbstractSshFuture.verifyResult(AbstractSshFuture.java:145)
  stdout F         at org.apache.sshd.client.future.DefaultConnectFuture.verify(DefaultConnectFuture.java:55)
  stdout F         at org.apache.sshd.client.future.DefaultConnectFuture.verify(DefaultConnectFuture.java:36)
  stdout F  at org.apache.sshd.common.future.VerifiableFuture.verify(VerifiableFuture.java:121)
  stdout F         at com.broadcom.vcf.lcm.sddc.build.plugins.common.util.SshKeyUtil.getSshThumbprints(SshKeyUtil.java:88)
  stdout F         ... 7 common frames omitted
  stdout F Caused by: java.net.ConnectException: Connection refused

Environment

VCF Operations 9.x

Cause

The failure because the VCF Service Runtime nodes (both control plane and workers) are not permitted to reach the SFTP server over Port 22.

Resolution

To resolve the issue and complete the backup schedule configuration:

1. Enable TCP port 22 connectivity between the VCF Service Runtime Nodes (both Control Plane and Worker Nodes) and the target SFTP backup server.

2. Configure the backup schedule for the  VCF Components .

Additional Information

SFTP backups of VCF Automation and VCF Identity Broker are failing

Network port requirements for VMware Cloud Foundation for Service Providers