Error: certificate.retrust.failed During VCF vCenter Certificate Replacement [VCF 9.1.1]

Products

VMware vCenter Server

Issue/Introduction

During a vCenter Server certificate replacement task within VCF Operations, the process fails with Error Code certificate.retrust.failed.

Certificate task REPLACE_CERTIFICATE for <VCENTER FQDN> has failed. Error message: Certificate replacement operation completed successfully on VCENTER component with FQDN <VCENTER FQDN>. However, automated post-update trust failed with errors: Retrust operations timed out after 30 minutes. Action required: Please perform manual re-trust with necessary components, so that communication path is not broken.

The error can be observed by navigating to VCF Operations > Operate > Administration > Control Panel > Management Tasks

Environment

VMware Cloud Foundation (VCF) 9.1.1

vCenter Server 9.1.1

Cause

This occurs when the automated post-update retrust operation times out, even if the certificate replacement on the vCenter component completes successfully.

A review of the VCF Operations vcops-bridge.log identified the retrustTargets (SDDC Manager, NSXT Manager, VCF Automation, etc) along with a message saying the retrust operatoin timed out after 30 minutes and to perform a manual re-trust with the necessary components.

INFO vcfops-bridge 6239 [ops@4413 threadId="513535" threadName="TasksManager-TaskHandler-5348" operationId=""] [com.vmware.vcops.bridge.server.vcf.certificate.task.SddcTaskResponseHandler.handleResult] - Got the results from Controller <controller>, result: VcfCertificateGenericTaskResult(super=com.vmware.vrops.nmp.task.certificate.VcfCertificateGenericTaskResult@33d6af02, taskId=<id>, taskResponseResult=ReplaceCertificateTaskResponse(retrustTargets=[RetrustTargetInfo(componentType=SDDC_MANAGER, fqdn=<SDDC Manager FQDN>, resourceId=<id>), RetrustTargetInfo(componentType=NSXT_MANAGER, fqdn=<NSXT Manager FQDN>, resourceId=<id>), RetrustTargetInfo(componentType=AUTOMATION, fqdn=<VCF Automation FQDN>, resourceId=<id>
...
INFO vcfops-bridge 6239 [ops@4413 threadId="513536" threadName="pool-53-thread-1" operationId=""] [com.vmware.vcops.bridge.server.vcf.certificate.persistence.VcfCertificateTaskDaoService.updateOrchestrationDetailsToTask] - Found orchestration task, Updating OrchestratorTask{id='<id>', type='null', name='null', description='Certificate replaced successfully. Retrust operations in progress.', status=IN_PROGRESS, lastUpdatedOn='null', errors=[]} to OrchestratorTask{id='<id>', type='null', name='null', description='null', status=FAILED, lastUpdatedOn='null', errors=[Error{message='Certificate replacement operation completed successfully on VCENTER component with FQDN <vCenter FQDN>. However, automated post-update trust failed with errors: Retrust operations timed out after 30 minutes. Action required: Please perform manual re-trust with necessary components, so that communication path is not broken.',

Resolution

1. Review vcops-bridge-*.log to identify the specific components listed in the retrustTargets array that caused the failure.

2. Check Component Connectivity: Verify the health and connectivity of each retrustTarget

SDDC Manager: Check Inventory > Workload Domains > Select Domain > Certificates
NSX Manager: Check System > Settings > Certificates and System > Compute Managers
VCF Automation: Check Administration > Certificate Management

3. Verify Credentials: If a component appears disconnected, re-validate or update the service account credentials used for that integration.

4. Manual Re-trust: Once you confirm connectivity, you may need to manually initiate the re-trust process for those components if the automated task does not automatically resume and clear the failure.

Consult the target product documentation for steps on performing a manual re-trust if needed

5. If the component remains disconnected or logs show persistent communication errors, gather a VCF Operations support bundle and contact support.

Additional Information

Contact Broadcom Support
https://knowledge.broadcom.com/external/article/206567

Generate VCF Operations Support Bundle in VCF 9
https://knowledge.broadcom.com/external/article/443789

"Error trying to establish connection" when validating vCenter Server connection
https://knowledge.broadcom.com/external/article/450409

"Failed to retrust AUTOMATION truststore" is returned during vCenter Certificate Replacement using VCF Operations UI
https://knowledge.broadcom.com/external/article/441506