Deployment Fails at 53% During Import VCF Operations in Fleet Lifecycle - VCF Management Components

Products

• VCF Operations

Issue/Introduction

• The deployment of VCF Management components fails  during the "Import VCF Operations in Fleet Lifecycle" stage of the deployment workflow. The process terminates with the following error: Unexpected error occurred
  
  
• Access the SDDC Build Service pod logs by running  #kubectl logs vcf-sddc-build-service-sddcbuild-########-#### -n vcf-sddc-lcm | less, where the following error message can be observed:

sddc-build service.log

YYYY-MM-DDTHH:MM:SS. ERROR sddc-build-service 52 [lcm@4413 scPath="ops" thread="system-task-worker-##" logger="c.b.v.l.s.b.p.common.util.SslUtil" method="getCertificateChain:120"] ######-####-####-####-######, taskId=######-####-####-####-######] - Error occurred while getting certificate chain for '<VCFOPSFQDN>:443'.
javax.net.ssl.SSLPeerUnverifiedException: No peer identity established
        at org.bouncycastle.jsse.provider.ProvSSLSessionBase.getPeerCertificates(ProvSSLSessionBase.java:177)
        at org.bouncycastle.jsse.provider.ExportSSLSession_7.getPeerCertificates(ExportSSLSession_7.java:91)

Environment

• VCF Operations 9.x

Cause

• The certificate installed on the VCF Operations node is missing the required Fully Qualified Domain Names (FQDNs) for all operation nodes within the Subject Alternative Name (SAN) field. The deployment service cannot establish a trusted SSL connection, resulting in an identity mismatch during the verification process.

Resolution

1. Access the VCF Operations node and inspect the certificate's SAN field to verify missing FQDN entries.
2. Regenerate the VCF Operations certificate to include all required FQDNs for the operation nodes within the Subject Alternative Name (SAN) attribute.
3. Ensure the new certificate is signed by a trusted authority (e.g., vCenter VMCA) and correctly applied to the VCF Operations instance.
   • For detailed steps on configuring certificates for VCF Operations, refer to Configure a Certificate For Use With VCF Operations
4. Once the certificate is updated and validated to include all necessary SAN entries, restart the 'Deploy VCF Management Components' task."

Verification: After applying the corrected certificate, the SDDC-build service should successfully validate the peer identity of the VCF Operations nodes, allowing the "Import VCF Operations in Fleet Lifecycle" stage to proceed past 53% and complete.