VCSA patching fails with SSL Certificate Verification Error due to incomplete rui.crt chain

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

While patching or upgrading vCenter Server Appliance (VCSA), specifically versions 8.x, the process becomes stuck or fails after the reboot step.

Reviewing the /var/log/vmware/vmon.log or service logs shows errors similar to:
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get issuer certificate (_ssl.c:1017)

Services such as vpxd-svcs fail to start.

Environment

VMware vCenter Server 8

Cause

The rui.crt files located in /etc/vmware-rhttpproxy/ssl/ and /etc/vmware-vpx/ssl/ contain an incomplete certificate chain. The file may be missing the root certificate hash, causing SSL verification to fail when services attempt to start.

Resolution

To resolve this issue, manually retrieve the missing root certificate and append it to the rui.crt files.

1. Log in to the vCenter Server Appliance via SSH as root.
2. Verify the number of certificate segments in the current rui.crt file:
   grep "BEGIN CERTIFICATE" /etc/vmware-vpx/ssl/rui.crt | wc -l
   Note: If the count is 3 and a 4-tier chain is expected, the root is likely missing.
3. Retrieve the missing root certificate from the VECS store:
   /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store TRUSTED_ROOTS --alias ####
   (Replace #### with the appropriate alias, often the SHA1 thumbprint of the root CA)
4. Back up the existing rui.crt files:
   cp /etc/vmware-vpx/ssl/rui.crt /etc/vmware-vpx/ssl/rui.crt.bak
cp /etc/vmware-rhttpproxy/ssl/rui.crt /etc/vmware-rhttpproxy/ssl/rui.crt.bak
5. Use a text editor (such as vi) to append the retrieved certificate hash (including the BEGIN and END markers) to the end of both files:
   /etc/vmware-vpx/ssl/rui.crt
/etc/vmware-rhttpproxy/ssl/rui.crt
6. Restart the vCenter services or resume the patching process:
   service-control --stop --all && service-control --start --all