Failed to generate SSL cert for vCenter HA

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to configure vCenter HA, you receive the following error in the UI:

A general system error occurred:
YYYY-MM-DDTHH:MM:SS Running command: ['chown', '-R', 'vpostgres:vpgmongrp', '/storage/db/vpostgres_ssl']
YYYY-MM-DDTHH:MM:SS Done running command
YYYY-MM-DDTHH:MM:SS Done to change path /storage/db/vpostgres_ssl owner to vpostgres
YYYY-MM-DDTHH:MM:SS Running command: ['/usr/lib/vmware-vmca/bin/certool', '--gencsr', '--privkey=/etc/vmware-vcha/ssl/<ACTIVE_NODE_IP>/node.priv', '--pubkey=/etc/vmware-vcha/ssl/<STANDBY/PASSIVE_NODE_IP>node.pub', '--csrfile=/etc/vmware-vcha/ssl/<STANDBY/PASSIVE_NODE_IP>/node.csr', '--config=/etc/vmware-vcha/ssl/<ACTIVE_NODE_IP>/node.cfg']
YYYY-MM-DDTHH:MM:SS Done running command
Failed to generate SSL certificate. Logs available at /var/log/vmware/vcha

• The vCenter log /var/log/vmware/vcha/prepare-vcha.log contains:
  
  YYYY-MM-DDTHH:MM:SSZ INFO prepare-vcha Generating Csr; node: <ACTIVE_NODE_IP>, cfg. path: /etc/vmware-vcha/ssl/<ACTIVE_NODE_IP>
  YYYY-MM-DDTHH:MM:SSZ INFO prepare-vcha /usr/lib/vmware-vmca/share/config/certool.cfg
  YYYY-MM-DDTHH:MM:SSZ INFO prepare-vcha Generating Csr; node: <STANDBY/PASSIVE_NODE_IP>, cfg. path: /etc/vmware-vcha/ssl/<STANDBY/PASSIVE_NODE_IP>
  YYYY-MM-DDTHH:MM:SSZ ERROR prepare-vcha Failed to generate SSL certificates
  Traceback (most recent call last):
    File "/usr/lib/vmware-vcha/scripts/preSetup.py", line 630, in generateSSLCertificates
      os.makedirs(path)
    File "/usr/lib/python3.10/os.py", line 225, in makedirs
      mkdir(name, mode)
  FileExistsError: [Errno 17] File exists: '/etc/vmware-vcha/ssl/<STANDBY/PASSIVE_NODE_IP>'

Cause

During the configuration of vCenter HA, a duplicate IP for the active node was entered for the passive or witness node. The vCenter HA prepare process creates the directory /etc/vmware-vcha/ssl/<NODE_IP> for the active, passive and standby nodes where each directory should be a unique IP address. If duplicate IPs are specified for the active, passive or standby nodes, the first directory (/etc/vmware-vcha/ssl/<NODE_IP>) will be created but the vCenter HA prepare process will fail when it goes to create the next directory since it already exist.

Resolution

When configuring vCenter HA, enter a unique IP address for the active, passive and witness nodes.