License Assignment Failures in VCF Operations Due to Certificate Conflicts

Products

• VCF Operations

Issue/Introduction

When attempting to assign a license to a vCenter Server through VMware Cloud Foundation (VCF) Operations, the assignment fails, and the vCenter Server remains on an evaluation license.

Additionally, you may observe the following:

• Warning indicators or error messages in the vCenter adapter UI within VCF Operations.
• Errors in the collector logs on VCF Operations.
• Certificate verification or integration errors in the vcf-licensing-plugin logs on VCF Operations.

Environment

VMware vCenter Server

VCF Operations 9.x

Cause

1. Duplicate CA Certificates: A duplicate Certificate Authority (CA) certificate exists within the VMware Endpoint Certificate Store (VECS) on the vCenter Server, causing trust validation to fail.
2. Incorrect Endpoint Integration: The vCenter integration in VCF Operations was configured using the vCenter IP address instead of its Fully Qualified Domain Name (FQDN).

Resolution

To resolve this issue, perform the following troubleshooting and remediation steps:

Step 1: Identify and Remove Duplicate Certificates as per KB: vCert - Scripted vCenter expired certificate replacement

1. SSH into the affected vCenter Server with root privileges.
2. Run the vCert tool to analyze the VECS store.
   Access the "Certificate Management Utility" choose option "3. Manage certificates" 
3. Verify if there is a duplicate CA certificate present.
   Choose option "3. CA certificates in VMware Directory"
4. If a duplicate CA certificate is detected, use the vCert tool to safely remove the duplicate certificate.
   Choose the option to delete the duplicate certificate.

Step 2: Update vCenter Integration in VCF Operations

1. Log in to VCF Operations.
2. Edit the integration settings for the affected vCenter Server.
3. Modify the endpoint details to use the vCenter FQDN (Fully Qualified Domain Name) instead of the IP address.

Step 3: Verify Plugin and Collection Status

1. Ensure that the VCF plugin is successfully deployed.
2. Verify that the collection status is active and in a "collecting" state.

Step 4: Re-assign the License

1. Go back to the licensing page in VCF Operations.
2. Attempt to assign the license to the vCenter Server again. The license assignment should now succeed.

Additional Information

Replacing Expiring Self-Signed VMware Certificate Authority (VMCA) Root Certificate on vCenter Server using the vCert script