vSphere Replication Site Pairing Fails - Unable to connect to Lookup Service: SSL handshake failed
Article ID: 452907
Updated On:
Products
Issue/Introduction
When attempting to pair sites and clicking FIND VCENTER SERVER INSTANCES, the operation fails instantly with the following UI error:Unable to connect to Lookup Service at https://production.broadcom.com:443/lookupservice/sdk. Reason: javax.net.ssl.SSLException: SSL handshake from 0.0.0.0/0.0.0.0:36960 to recovery.broadcom.com/10.#.#.#:443 failed in 7 ms
Environment
vSphere Replication 9.x
Cause
Reviewing the appliance logs reveals that the network connection is being actively rejected during the initial handshake:
/var/log/vmware/dr-client/dr.log :
com.vmware.vim.vmomi.client.exception.SslException: Unable to connect to Lookup Service at https://production.broadcom.com:443/lookupservice/sdk. Reason: javax.net.ssl.SSLException: SSL handshake from 0.0.0.0/0.0.0.0:40338 to recovery.broadcom.com/10.#.#.#:443 failed in 4 ms
at com.vmware.vim.vmomi.client.common.impl.ResponseImpl.setError(ResponseImpl.java:265)
at com.vmware.vim.vmomi.client.http.impl.HttpExchangeBase.setResponseError(HttpExchangeBase.java:362)
at com.vmware.vim.vmomi.client.http.impl.HttpExchange.invokeWithinScope(HttpExchange.java:59)
at com.vmware.vim.vmomi.core.tracing.NoopTracer$NoopSpan.runWithinSpanContext(NoopTracer.java:120)
at com.vmware.vim.vmomi.client.http.impl.TracingScopedRunnable.run(TracingScopedRunnable.java:17)
at com.vmware.vim.vmomi.client.http.impl.HttpExchangeBase.run(HttpExchangeBase.java:52)
at com.vmware.dr.ui.tools.utilities.ThreadContext.lambda$wrap$1(ThreadContext.java:55)
at com.vmware.dr.ui.tools.utilities.ThreadContext.execute(ThreadContext.java:209)
at com.vmware.dr.ui.tools.utilities.ThreadContext.execute(ThreadContext.java:185)
at com.vmware.dr.ui.tools.utilities.ThreadContext.setupContext(ThreadContext.java:76)
at com.vmware.dr.ui.tools.utilities.ThreadContext.setupContext(ThreadContext.java:105)
at com.vmware.dr.ui.tools.utilities.ExecutorUtils.lambda$wrap$1(ExecutorUtils.java:36)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLException: SSL handshake from 0.0.0.0/0.0.0.0:40338 to recovery.broadcom.com/10.#.#.#:443 failed in 4 ms
/var/log/vmware/dr/drconfig.log:
2026-08-08T18:37:00.704Z warning drconfig[06310] [SRM@6876 sub=IO.Connection opID=bc5716b7-444e-4032-9714-############-probeSsl] Failed to SSL handshake; SSL(<io_obj p:0x00007fc60c008850, h:25, <TCP '10.#.#.# : 57372'>, <TCP '10.#.#.# : 443'>>), e: 167772294(certificate verify failed (SSL routines)), duration: 4msec
2026-08-08T18:37:00.704Z warning drconfig[06310] [SRM@6876 sub=ProbeSsl.Url.DrConfigSslCertificateManager opID=bc5716b7-444e-4032-9714-############-probeSsl] SSL client handshake to 'production.srm.com:443' failed.
--> N7Vmacore3Ssl18SSLVerifyExceptionE SSL Exception: Verification parameters:
--> PeerThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
--> ExpectedThumbprint:
--> ExpectedPeerName: production.srm.com
--> The remote host certificate has these problems:
-->
--> * unable to get local issuer certificate
Site Pairing (Connection Reset): The SSL handshake failure is a TCP/IP network rejection, not a certificate thumbprint mismatch. An inline network security device (such as a firewall, AWS security group, load balancer, or IDS/IPS) is allowing the basic TCP connection but actively killing the connection (dropping the SSL Client Hello packet). In this specific scenario, a required outgoing firewall rule for the VRMS appliance over port 8043 was missing on the target/DR site.
Resolution
Engage your network or cloud security team to verify traffic flow between the source and destination Appliances.
Ensure that an outbound firewall rule is configured to allow traffic over port 8043 for the target Appliance.
Note for Network Teams: Ensure that no SSL Decryption/Deep Packet Inspection (DPI) is intercepting the traffic between the appliances, as VMware requires strict mutual TLS pinning.
Additional Information
Feedback
