"The license file is invalid" when applying Private License files in VCF Operations 9.1 CI environments

Products

• VCF Operations

Issue/Introduction

During a new deployment of VCF Operations 9.1 in a Critical Infrastructure (CI) or disconnected environment, importing a private license file fails.

The VCF Operations UI displays the error:

"The license file is invalid. Generate a new license file in the VCF Business Services console and upload it here"

The license-usage-plugin logs display the error:

"Failed to get Critical infra Identity for license server".

Environment

VCF 9.1.x

Cause

VCF 9.1 private licensing requires custom RSA key pairs to establish cryptographic identities for the appliances.  

The private license import fails because these keys must be manually imported into both the License Server and VCF Operations using direct API calls prior to adding the license file.  

https://<licenseServerIP_or_FQDN>/lss/external/api/v1/identity/key.

The VCF 9.1 Licensing - Private License Files documentation lacks clear, sequential workflow steps for this requirement, separating the mandatory API execution instructions from the main deployment guide.   

Resolution

To resolve the identity failure and allow the private license to validate, apply the RSA key pairs using the following sequence:

1. Generate Key Pairs: Create one RSA private/public key pair for VCF Operations and a separate key pair for the License Server.  

2. Format the VCF Operations Key: Combine the VCF Operations private and public keys into a single .pem file, with the private key section appearing first.

3. Import the License Server Key: Use a REST client to POST the License Server private key .pem file to

https://<licenseServerIP_or_FQDN>/lss/external/api/v1/identity/key.

Include the header X-API-Key utilizing the API key defined during the License Server deployment.

4.   Import the VCF Operations Key: Navigate to

https://<VCF_Operations_Instance>/suite-api/doc/swagger-ui.html,

switch the definition drop-down to Internal APIs, and use the POST /internal/license-manager/identity/keypair endpoint to upload the combined .pem file. 

Additional Information

Refer to the VCF 9.1 Licensing - Private License Files document, specifically the detailed API sections on pages 13 and 14, for complete payload examples.  

For similar "invalid license" error signatures resulting from legacy 9.0 registration metadata conflicts, review KB 455505.