VCF Upgrade fails at "Replace License Server certificate with VMCA-signed certificate" with API Error 18068

Products

VMware SDDC Manager / VCF Installer VMware Cloud Foundation VMware vCenter Server

Issue/Introduction

When upgrading VMware Cloud Foundation (e.g., from 5.2 to 9.1.1), the upgrade workflow fails during the VCF Management services installation phase.

The SDDC Manager UI displays the following error:

Failed to update License Server certificate with VMCA

The suite-api logs or UI details show a 400 Bad Request error.
Cause: org.springframework.web.client.HttpClientErrorException$BadRequest: 400 on PUT request for "https://[hostname]/suite-api/internal/extension/vcf-license-cloud-integration/license-servers/[ID]/certificate": "{"type":"Error","message":"Failed to replace license server certificate.","moreInformation":[{"name":"errorMessage","value":"Failed to replace license server certificate."}],"httpStatusCode":400,"apiErrorCode":18068}"

The VCF Ops Logs show the following errors in /storage/log/vcops/log/license-usage-plugin-########-####-####-####-############.log:

ERROR license-usage-plugin 7374 [ops@4413 threadId="381" threadName="ServerConnection on port 10000 Thread 1" operationId="c######################R58X"]
[com.vmware.vrops.license. usage.server.LicenseUsageInterfaceJavaProxy.invoke] - LicenseUsageInterfaceSpringProxy : Exception thrown by the actual source
ERROR license-usage-plugin 7374 [ops@4413 threadId="381" threadName="ServerConnection on port 10000 Thread 1" operationId="c######################R58X"]
[com.vmware.vrops.license.usage.utils.LicenseServerExceptionHandler.handleLicenseUsageRuntimeException] - LicenseUsageRuntime : Failed to perform the operation : LicenseUsageInterface.replaceLicenseServerCertificateChain
com.vmware.vrops.license.usage.exception. LicenseUsageRuntimeException: Failed to replace license server certificate.
at com.vmware.vrops.license.usage.service. LicenseServerService.replaceLicenseserverCertificateChain(LicenseServerService.java:1576)

Caused by: org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 on POST request for "ls://3#####77-####-####-##d7-#########90/lss/api/v1/certificate": "{"code":19005, "message":"Invalid certificate
chain","cause":null}"

Verify DNS resolution for both the License Server and the vCenter Server by running the following command:
```
nslookup <IP_Address>
```

Environment

VMware Cloud Foundation 9.x
VMware vCenter Server 9.x

Cause

This issue occurs due to environmental prerequisites failing during the certificate replacement process. Specifically, it is caused by a time synchronization drift between the vCenter Server and the License Server.

Certificate replacement requires strict time synchronization and proper hostname resolution. A time drift (e.g., 20 seconds or more) combined with a DNS_RESOLUTION_FAILURE on the License Server prevents the necessary secure communication and validation required to push the VMCA-signed certificate.

Resolution

To resolve this issue, time synchronization and DNS resolution must be restored between the appliances:

Verify the current time on both the vCenter Server and the License Server to identify the drift.
Log in to both the vCenter Server and the License Server via SSH and run the date command on each appliance to compare the current times.
Correct the NTP configuration on the appliances to ensure time is perfectly synchronized.
If the NTP drift or network disruption persists, migrate the vCenter Server and the License Server to the same ESXi host to isolate network-timing issues.
Reboot the License Server appliance to refresh the networking services and restore DNS connectivity.
Log into the License Server console to verify that the DNS_RESOLUTION_FAILURE is no longer present and that it can successfully resolve the vCenter Server FQDN.
Return to the SDDC Manager UI and retry the failed upgrade task.