SOS NTP health check for vCenter fails with SSL certificate verification - ERROR: "certificate verify failed: Basic Constraints of CA cert not marked critical"

Products

• VMware Cloud Foundation
• VMware vCenter Server
• VMware SDDC Manager / VCF Installer

Issue/Introduction

In VMware Cloud Foundation (VCF), running the Supportability and Serviceability (SoS) utility commands (such as sos --ntp-health or sos --vc-logs) against a vCenter Server configured with a custom Certificate Authority (CA) fails during the TLS handshake stage.

The operation terminates before an HTTP response is returned, exhibiting the following traceback: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1081)

Additional errors observed in the sos.log include: requests.exceptions.SSLError: HTTPSConnectionPool(host='<REDACTED_HOSTNAME>', port=443): Max retries exceeded with url: /api/session (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1081)')))

 

<TIMESTAMP> ERROR vcf_sos 226379 [sddcm@4413 threadId="_parallel_check_vc_ntp_configuredThread0" class="restutil" method="post" line="355"] Traceback (most recent call last):
  File "/opt/vmware/sddc-support/framework/../dependency/urllib3/connectionpool.py", line 464, in _make_request
    self._validate_conn(conn)
  File "/opt/vmware/sddc-support/framework/../dependency/urllib3/connectionpool.py", line 1106, in _validate_conn
    conn.connect()
  File "/opt/vmware/sddc-support/framework/../dependency/urllib3/connection.py", line 796, in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(

Environment

VMware Cloud Foundation (VCF) 9.1.1

vCenter Server 8.0.x

Cause

The underlying platform in VCF 9.1.1 utilizes OpenSSL  and Python respective versions, which strictly enforce RFC 5280 §4.2.1.9 security standards.

The custom CA certificate in the vCenter Server's TLS chain was generated without setting basicConstraints=critical. Because the X.509v3 Basic Constraints extension is present but not marked as critical, the Python SSL stack actively rejects the CA certificate during validation and refuses the connection.

Resolution

Inspect the NTP configuration of the vCenter server manually:

 

1. Log in to the vCenter VAMI and check the NTP status.

2. SSH into the vCenter Server Appliance using the root account.

3. Access the bash shell by typing shell and pressing Enter.

4. Run the standard NTP query command: ntpq -p.

5. Verify the asterisk (*) is present in the output, which indicates the active peer your vCenter is currently synchronized with.

 

Review the certificate information:

 

1. Inspect the active CA certificate chain applied to the affected vCenter Server to confirm the Basic Constraints extension is missing the critical flag.

2. Contact your internal PKI or Certificate Authority (CA) administrator to re-issue the root and/or intermediate CA certificates. Ensure the certificate profile is configured to mark the Basic Constraints extension as Critical (e.g., CA:TRUE, marked as critical).

3. Once the updated, RFC 5280-compliant CA certificate chain and signed components are issued, navigate to the SDDC Manager UI.

4. Go to Security > Certificate Management and execute the certificate replacement workflow for the affected vCenter Server using the newly generated certificates.

5. After the certificate replacement workflow completes successfully, return to the SDDC Manager terminal and re-run the sos --ntp-health command to verify the health check passes without SSL traceback errors.

 

As a temporary workaround to permit SoS log collection while the certificate is being corrected, execute the SoS command by appending the --skip-cert-check flag to bypass strict TLS validation.

Example: /opt/vmware/sddc-support/sos --vc-logs --zip --skip-cert-check

 

Additional Information

RFC 5280 - Basic Constraints