Greenfield VCF Automation 9.1 deployment fails with error "Failed to retrieve resource certificate from SDDC Manager"

Products

• VCF Automation

Issue/Introduction

Deploying VCF Automation 9.1 via VCF Operations 9.1 (Navigate to: Build > Lifecycle > VCF Instance > Components > Add Component > VCF Automation) fails. Multiple deployment sub-tasks fail with the following error: Failed to retrieve resource certificate from SDDC Manager

Reviewing the logs reveals the following error details:

• fleet-lcm / sddc-lcm: Tasks fail at the fetch_vsp_cluster_cert_from_sddc_manager_ref / GetResourceCertificates step with com.broadcom.vcf.sddcmanager.client.exception.SddcManagerClientException.

• operationsmanager.log: CertificateOperationsFacadeImpl.getCertificatesFromDomain throws com.vmware.vcf.certmgmt.common.exception.CertificateManagementException: Failed to fetch the domaindetails for domain <domain_id> with error code [8M0Q5N] CERTIFICATE_RESOURCE_DATA_NOT_FOUND.

• operationsmanager.log / domainmanager.log: ERROR NetworkService - Host <old_vcfa_fqdn> cannot be resolved: Name or service not known and Cannot determine IP address for FQDN <old_vcfa_fqdn>.

Environment

• VMware Cloud Foundation (VCF) 9.1

• VCF Automation 9.1

• VCF Operations 9.1

• SDDC Manager

Cause

• An improper cleanup of a previous VCF Automation instance using the cleanup_component.py script from KB441333 removes the virtual machines/appliances but does not call SDDC Manager's VSP cluster deregistration API.
• This leaves a stale inventory record (platformFqdn) in the SDDC Manager database. When the old DNS record is removed, the orphaned entry becomes unresolvable and prevents domain-wide resource and certificate retrievals during subsequent deployments.

Resolution

• This requires database investigation, isolation and modification to remove the stale references. Thus, we recommend reaching out to Broadcom Support referencing the KB453174.