SDDC Manager Upgrade Precheck fails with "vSphere SHA-1 validation" despite backend success
search cancel

SDDC Manager Upgrade Precheck fails with "vSphere SHA-1 validation" despite backend success

book

Article ID: 453459

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

When running an upgrade precheck in SDDC Manager, the check fails with the following status in the UI:

  • Check Name: vSphere SHA-1 validation

  • Error Message: vSphere SHA-1 validation failed. High: Do not perform upgrade without addressing this issue.

  • UI Error Remediation Text: Check the /var/log/vmware/vcf/operationsmanager/assessment/pythonvalidations/<UUID>/artifacts/vsphere-sha1-validation-execution-error-<UUID>.txt file for more details.

However, upon inspecting the specified log file in the SDDC Manager appliance, the assessment script log ends with:

Plaintext
 
INFO Verifing vCenter Server VECS store: MACHINE_SSL_CERT
INFO Verifing vCenter Server VECS store: TRUSTED_ROOTS
...
INFO Verifying ESXi host 14 of 14: <host_fqdn>
INFO Validation was successful.

Environment

SDDC Manager 5.2.1 / VCF 5.x

Cause

This issue occurs due to a stale cached state or a temporary TLS session timeout within the SDDC Manager Operations Manager service framework (operationsmanager).

Even though the underlying Python script (vsphere8_upgrade_certificate_checks.py) successfully executes against the vCenter Server and ESXi hosts, Operations Manager retains the previous failed status in its internal evaluation cache or fails to update the status flag following an earlier transient RPC issue.

Resolution

Step 1: Audit VECS Certificates on the vCenter Server

  1. Log in to the vCenter Server Appliance via SSH as root.

  2. Enable the Bash shell (if prompted):

    Bash
    shell

  3. Run the following command to iterate through all VECS stores and print the Signature Algorithm for every entry:

    for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo "STORE::  $i"; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep -i "Alias|Signature Algorithm"; done

  4. Confirm that all output entries display sha256WithRSAEncryption (or higher) and that sha1WithRSAEncryption is NOT present in any store (MACHINE_SSL_CERT, TRUSTED_ROOTS, vpxd, SMS, etc.).

Step 2: Verify the SDDC Manager Backend Validation Log

  1. Log in to the SDDC Manager appliance via SSH as vcf and switch to root:

    su -

  2. Check the specific artifact log file indicated in the SDDC Manager UI error details:

    cat /var/log/vmware/vcf/operationsmanager/assessment/pythonvalidations/<EXECUTION_UUID>/artifacts/vsphere-sha1-validation-execution-error-<ARTIFACT_UUID>.txt

  3. Confirm that the final line of the execution output reads: INFO Validation was successful.

Step 3: Clear the Operations Manager Cache

  1. Restart the Operations Manager service on SDDC Manager to flush the internal precheck state:

    systemctl restart operationsmanager

  2. Allow 2–3 minutes for all dependent services to re-initialize.

Step 4: Force TLS Handshake / Cache Refresh

  1. From SDDC Manager, force an explicit TLS handshake directly to the target vCenter:

    openssl s_client -connect <vcenter-fqdn>:443 -showcerts

  2. Send a curl request to ensure the API endpoint updates its local SSL session state:

    curl -v -k https://<vcenter-fqdn>/sdk

Step 5: Retry the Upgrade Precheck

  1. Log back into the SDDC Manager UI.

  2. Navigate to Inventory > Workload Domains > [Domain Name] > Updates.

  3. Click Retry All Failed Resources or run a fresh Precheck.

The vSphere SHA-1 validation error will clear, and the status will update to Passed.

Additional Information

If both the vCenter VECS store command returns only SHA-256 signatures and the SDDC Manager backend execution output shows INFO Validation was successful., this UI warning is a false positive caused by UI state caching. It is safe to proceed with the lifecycle upgrade once verified via these backend steps.

Powered by Wolken Software