Log collection trust broken for workload domain after certificate update

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• On the Infrastructure Operations > Configurations > Log Collection page in VCF Operations, the vCenter status shows as Failed.
• The following errors are observed in the log-processor pod logs:

• • javax.net.ssl.SSLException: org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
  • java.security.cert.CertificateException: Unable to construct a valid chain at org.bouncycastle.jsse.provider.ProvX509TrustManager.validateChain.

Environment

• VMware Cloud Foundation (VCF) 9.0.x, 9.1
• VCF Operations 9.x

Cause

The VCF Operations log processor is unable to validate the certificate chain presented by the vCenter after a certificate update, causing the TLS handshake to fail.

Resolution

1. Log in to the VCF Operations UI.
2. Navigate to Integrations > vCenter.
3. Select the affected vCenter and click Validate Connection to re-establish trust.
4. If the status remains Failed, log in to the collector node as root via SSH.
5. Restart the vcf-log-forwarder container: docker restart vcf-log-forwarder
6. If the issue persists in a multi-node cluster, restart the VCF Operations for Logs nodes via Management > Cluster, starting with non-ILB nodes first.
7. Renew the certificates in the affected Workload Domain if the trust is still not established.