ERROR: "root:Failed to test vsan vmodl version with error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain"

Products

• VMware vSAN
• VMware Telco Cloud Infrastructure

Issue/Introduction

• When executing python /usr/lib/vmware/vsan/bin/reboot_helper.py recover on an ESXi host, the vSAN cluster recovery process fails due to Python SSL certificate verification errors.
  

  ERROR:root:Failed to test vsan vmodl version with error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1131) on <REDACTED_IP> Failed to connect host <REDACTED_IP>, skipping it...
  Timeout, please try again later

Environment

ESXi: 7.0 U3

TCI: 2.7

Cause

• Python SSL certificate validation fails during inter-host vMODL API connections due to untrusted or self-signed certificates in the host certificate chain.

Resolution

 

1. Connect to each ESXi host in the cluster via SSH as root.

2. Revert advanced vSAN parameters on all cluster nodes:

   esxcfg-advcfg -s 0 /VSAN/DOMPauseAllCCPs
   esxcfg-advcfg -s 0 /VSAN/IgnoreClusterMemberListUpdates
   

3. Exit maintenance mode on all ESXi hosts:

   esxcli system maintenanceMode set --enable false
   

4. Verify cluster membership and state:

   esxcli vsan cluster get
   

5. Verify vSAN object health summary:

   esxcli vsan debug object health summary get
   

6. (Optional) To resolve the SSL issue for script execution, renew host certificates in vSphere Client under Configure > System > Certificate > Renew, then re-run python /usr/lib/vmware/vsan/bin/reboot_helper.py recover.