License Server SSL Certificates Are Not Trusted by vCenter Instance

Products

• VCF Operations

Issue/Introduction

•  vCenter server is missing from the "vCenter Systems" view under Licensing and Registration in VCF Operations.
• The license server SSL certificates are not trusted by the vCenter instance, preventing VCF Operations from successfully assigning licenses.
  
  Error: The license server SSL certificates are not trusted by the vCenter instance. Ensure the configured action username, or if not used, the default username for the vCenter cloud account has Certificate Management.Manage privileges. Please refer to KB article 424533 for more information.
  
  
• The /usr/lib/vmware-vcops/user/log/license-usage-plugin-####-########-#####.log shows license server certificates attempting to sync to the vCenter trusted store:

YYYY-MM-DDTHH:MM:SS.MSZ INFO license-usage-plugin ##### [ops@##### threadId="290" threadName="DistTaskReconcileLicenseServerSchedule" operationId=""] [com.vmware.vrops.license.usage.task.reconcile.TrustedChainUpdateAction.synchronizeLicenseServerCertificates] - Synchronizing License Server Trusted Roots to attached VCs.
YYYY-MM-DDTHH:MM:SS.MSZ INFO license-usage-plugin ##### [ops@##### threadId="290" threadName="DistTaskReconcileLicenseServerSchedule" operationId=""] [com.vmware.vrops.license.usage.task.reconcile.TrustedChainUpdateAction.lambda$synchronizeLicenseServerCertificates$1] - Dispatching cert to 
YYYY-MM-DDTHH:MM:SS.MSZ INFO license-usage-plugin #####[ops@##### threadId="290" threadName="DistTaskReconcileLicenseServerSchedule" operationId=""] [com.vmware.vrops.license.usage.task.LicenseUsageTaskDispatcher.updateLicenseServerCertificateOnVIM] - Sending certificate chain to adapter: 
YYYY-MM-DDTHH:MM:SS.MSZ INFO license-usage-plugin ##### [ops@##### threadId="290" threadName="DistTaskReconcileLicenseServerSchedule" operationId=""] [com.vmware.vrops.license.usage.task.LicenseUsageTaskDispatcher.updateLicenseServerCertificateOnVIM] - LS Cert Distribution Result: Propagated certificate to VCs.




Environment

• VCF Operations 9.1.x

Cause

 The vCenter instance does not trust the License Server SSL certificates, or the vCenter cloud account lacks the necessary permissions to manage certificates.

Resolution

1. Ensure the account used for the vCenter cloud account integration has the CertificateManagement.Manage and Global.Licenses privileges assigned in vCenter.
2. Manually download the root certificate from the /usr/lib/vmware-vcops/user/log/license-server-proxy-####-######-######.log file.
   
   
   1. YYYY-MM-DDTHH:MM:SS.MSZ INFO license-server-proxy ##### [ops@#### threadId="260" threadName="DistTaskEntitlementVcUsageSyncScheduler" operationId=""] [com.vmware.vrops.licenseserver.proxy.http.LoggingInterceptor.intercept] - {"licenseServerId":"########-####-####-####-############","method":"POST","path":"/lss/api/v1/apikey","requestBody":"[\"########-####-####-####-############\",\"########-####-####-####-############\"]","status":200,"startTime":##############,"elapsedTimeMillis":##############}
YYYY-MM-DDTHH:MM:SS.MSZ INFO license-server-proxy ##### [ops@#### threadId="290" threadName="DistTaskReconcileLicenseServerSchedule" operationId=""] [com.vmware.vrops.licenseserver.proxy.http.LoggingInterceptor.intercept] - {"licenseServerId":"########-####-####-####-############","method":"GET","path":"/lss/api/v1/certificate/trustedchain","status":200,"responseBody":"{\"trustedChain\":[\"-----BEGIN CERTIFICATE-----\\<ENCRYPTED DATA>/<ENCRYPTED DATA>\\n-----END CERTIFICATE-----\"],\"ip\":\"###.##.###.##\",\"hostname\":\"<FQDN>\"}","startTime":##############,"elapsedTimeMillis":##############}

   2. Copy the certificate encoded value from {\"trustedChain\":[\"-----BEGIN CERTIFICATE-----\\/\\n-----END CERTIFICATE-----\"]
   3. Save the encoded value to a crt file.
3. Import the saved from Step#1 certificate into the vCenter trusted root store.
4. Verify that VCF Operations can now successfully assign the license to the vCenter server.