Unable to access VMware Cloud Director web UI after changing load balancer from Layer 7 to Layer 4 - VMware Cloud Director

Products

• VMware Cloud Director

Issue/Introduction

After changing the load balancer (LB) configuration for VMware Cloud Director (VCD) cells from Layer 7 (SSL termination) to Layer 4 (SSL passthrough), the web UI becomes inaccessible. This occurs because the load balancer is no longer handling SSL termination; the VCD cells are now forced to present their own internal certificates, which often causes handshake failures or untrusted certificate errors.

Environment

VMware Cloud Director 10.6.x

Cause

When the Load Balancer is configured for Layer 7, it terminates SSL using a valid public certificate. When switched to Layer 4, the Load Balancer performs SSL passthrough, passing the termination responsibility to the VCD cells. If the cell certificates are expired or self-signed, the client browser will reject the connection, resulting in a "503 Service Unavailable" or certificate error.

Resolution

1. Revert to Layer 7 (Temporary): If immediate access is required, revert the load balancer configuration to Layer 7 to restore SSL termination.
2. Verify Cell Certificates: Log into the VCD Provider UI or check the appliance management interface to determine if the cell certificates are valid.
3. Replace Expired Certificates: If the certificates are expired or invalid, follow the comprehensive steps in KB 379244 - How to Replace the Public/HTTPS Certificate in VMware Cloud Director to generate and apply valid certificates.
4. Configure Public Addresses: Ensure the public addresses match the new certificate by following the guide: Customize the Public Addresses for Your VMware Cloud Director Appliance.
5. Re-apply Layer 4 Configuration: Once valid certificates are applied to the cells and verified, you may re-apply the Layer 4 configuration on the load balancer.
6. Validate Access: Confirm access to the VMware Cloud Director web UI.

Additional Information

• To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.
• For general downloads and patch information, see: Download Broadcom Products and Software.