VCF 9.1 upgrades fail if component is using a wild card certificate

Products

VMware SDDC Manager / VCF Installer VCF Operations VMware NSX

Issue/Introduction

A similar error is observed in the SDDC Manager's lcm-debug.log

/var/log/vmware/vcf/lcm/lcm-debug.log

{{10:58:12.338Z WARNING NsxtConnectionFactory handleSslException SSL exception connecting to ########.####.###. Attempting retrust.
10:58:12.403Z INFO CertificateRetrustService URL: /certificate-management/certificate-bundle, HTTP status code: 200
10:58:12.773Z INFO CertificateRetrustService Certificate validation Successful. New certificate:
10:58:12.810Z INFO CertificateRetrustService URL: /appliancemanager/certificates, HTTP status code: 400
10:58:12.811Z ERROR CertificateRetrustService Failed to retrust ... {"errorCode":"REST_INVALID_API_INPUT","nestedErrors":[
{"errorCode":"ANNOTATIONS_MISMATCH","arguments":["appliance.CS_APPLIANCE_CERT_ALIAS_INVALID"]}
],"referenceToken":"CQ9J2R"}
10:58:12.884Z ERROR PubUploadAndInstallTasksFireAction could not retrieve nsx cluster or connection to upload bundle d1d2ac10-0f21-46f3-901f-f47b62252b16
10:58:12.887Z DEBUG Transition Action ... SetupState -> initEvent -> PollSetupState, will be retried. Attempt : 0
11:03:12.295Z DEBUG AsyncFsm 300001 ms spent in SetupState, which exceeds allowed duration by 1 ms
11:03:12.297Z DEBUG AsyncFsm State timeout exceeded, Terminating the task.
11:03:12.317Z DEBUG PrecheckTaskUtil ResourceResults is empty for task: 8fd8e2e2-... status: TIMED_OUT}}
Stack trace (root frame):
{{java.io.IOException: {"errorCode":"REST_INVALID_API_INPUT", ... CS_APPLIANCE_CERT_ALIAS_INVALID ...}
at ...CertificateRetrustService.lambda$execute$0(CertificateRetrustService.java:188) <- ROOT CAUSE
at ...CertificateRetrustService.addTrustedCertificatesAndRefresh(CertificateRetrustService.java:159)
at ...CertificateRetrustService.retrustWithTheServer(CertificateRetrustService.java:73)
at ...NsxtConnectionFactory.handleSslException(NsxtConnectionFactory.java:138)
at ...InventoryClientImpl.openNsxtManagerConnectionWithRetries(InventoryClientImpl.java:3236)}}
Certificate served by the VIP (openssl s_client from SDDC Manager, read-only):

Environment

VMware Cloud Foundation 9.1

Cause

In SDDC Manager 9.1.1, new certificate alias restrictions were introduced. Aliases are now restricted to non-special characters only. Because aliases are computed from the certificate's Common Name (CN), wildcard characters (such as *) are no longer included in the 'allowed list' for CNs. Any component offering a certificate with a wildcard CN to SDDC Manager will cause the retrust and upgrade process to fail.

Resolution

Identify the specific component (e.g., NSX Manager) currently serving the wildcard certificate.
Generate a new Certificate Signing Request (CSR) for the component.

Ensure the Common Name (CN) uses only the following allowed characters:
```
Letters (a-z, A-Z)
Digits (0-9)
Periods (.) (Note: No consecutive periods allowed)
Underscores (_)
Hyphens (-)
Colons (:)
```
Re-issue and install the new certificate on the component.
Retry the upgrade or retrust operation in SDDC Manager.