BOSH stemcell creation failed with error certificate verify failed (unable to get local issuer certificate)

Products

• VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

This article describes the resolution for stemcell creation failures during an Ops Manager upgrade. The error occurs when the BOSH Director cannot verify the SSL certificate of the ESXi host during the NFC (Network File Copy) disk upload process.

CPI 'create_stemcell' method responded with error: CmdError{"type":"Unknown","message":"The URL https://<ESXI-IP-OR-FQDN>/nfc/52c13457-45bf-0ca0-6d05-8028074311d9/disk-0.vmdk does not have a valid SSL certificate. You may use the manifest property 'vcenter.connection_options.ca_cert' in the global CPI config to set a trusted CA CERTIFICATE, PEM-encoded. Exception: SSL_connect returned=1 errno=0 peeraddr=<ESXI-IP>:443 state=error: certificate verify failed (unable to get local issuer certificate)","ok_to_retry":false}

Exit code 1
===== 2026-08-25 14:08:31 UTC Finished "/usr/local/bin/bosh --no-color --non-interactive --tty create-env --skip-drain /var/tempest/workspaces/default/deployments/bosh.yml -l /var/tempest/workspaces/default/deployments/vars.yml --package-dir /var/vcap/packages"; Duration: 58s; Exit Status: 1

Environment

• Product: VMware Tanzu Platform for Cloud Foundry
• Environment: Ops Manager 3.3.4 (or similar versions)

Cause

Stemcell and VMDK uploads use NFC (Network File Copy) protocol, which redirects the transfer directly to the ESXi host owning the datastore, rather than vCenter. The ESXi host presents a VMCA-signed machine certificate that is not trusted by the Ops Manager OS trust store ausing the failure.

Resolution

Add the VMCA root certificate to the bosh director tile settings

1. Obtain the VMCA root certificate from your vSphere environment:
   • Navigate to: https://<VCENTER-FQDN>/certs/download.zip
   • Alternatively: vSphere Client → Administration → Certificate Management.
2. Unzip the artifacts and locate the .0 file under certs/lin/. Verify it is PEM-encoded (the file should start with -----BEGIN CERTIFICATE-----).
3. Navigate to the BOSH Director tile in Ops Manager.
4. Add the VMCA root certificate under the Bosh Director Tile → vCenter Config → vCenter CA Certificate field.
5. Run Apply Changes.

Additional Information

For further support, see Contact Broadcom Support