The provided FQDN for VCF Operation does not respond correctly. Ensure that the correct VCF Operations details are provided, error received while connecting to Existing VCF Operations

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Attempting to deploy VCF Management Services on an existing VMware vSphere Foundation (VVF) 9.1 deployment fails at Existing VCF Operations, with error :

• The VCF Installer UI displays an error indicating the provided FQDN does not respond correctly:
  
  The provided FQDN for VCF Operation [vc_ops_fqdn] does not respond correctly. Ensure that the correct VCF Operations details are provided.

• /var/log/vmware/vcf/domainmanager/domainamanger.log reveals an SSL certificate validation error similar to the following:
  
  ^{yyyy-mm-ddThh:mm:ss ERROR [vcf_dm,6a7c2afccfb326a3899f60f800c1175d,a4b8] [c.v.v.v.s.DiscoveryServiceImpl,http-nio-127.0.0.1-7200-exec-1]  Unable to get version from VCF Ops address <vcf_ops_fqdn>
  com.vmware.evo.sddc.common.services.vrops.VropsApiException: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://<vcf_ops_fqdn>/casa/sysadmin/slice/vmware/buildinfo":
  Certificate for <vcf_ops_fqdn> doesn't match any of the subject alternative names: [localhost, vcf_ops]
          at com.vmware.evo.sddc.common.services.vrops.impl.VcfOpsServiceImpl.getVcfOpsVersion(VcfOpsServiceImpl.java:258)
          at com.vmware.vcf.vimanager.services.DiscoveryServiceImpl.discoverVcfOps(DiscoveryServiceImpl.java:187)}

Environment

VVF 9.1
VCF Operations 9.1

Cause

This issue occurs because the SSL certificate installed on the existing VCF Operations node is misconfigured. The Subject Alternative Name (SAN) field of the certificate contains localhost (and/or shortnames) instead of the proper Fully Qualified Domain Name (FQDN) of the appliance.

Resolution

To resolve this issue, you must replace the certificate on the VCF Operations node with a newly generated one that includes the correct FQDN in the Subject Alternative Name (SAN) extension.

1. Generate a new Certificate Signing Request (CSR) ensuring the subjectAltName includes the correct Primary Node FQDN.

2. Sign the certificate using your Certificate Authority (or the vCenter Trusted Root for VMCA).

3. Install the updated certificate via the VCF Operations Administrator interface (https://<vcf-ops-fqdn>/admin).

Step-by-step instructions on generating certificate with the correct SAN details, creating the CSR, and applying the .pem certificate in the VCF Operations UI, please refer to the following Broadcom Knowledge Base article- Configure a Certificate For Use With VCF Operations .

Additional Information

VCF Operations deployment fails with "localhost" hostname and certificate validation errors during VCF 9.1 installation