"A general system error occurred: Cannot download VIB" error while staging the ESXi patch using lifecycle manager with Token based URL - Token Not Entitled

Products

• VMware vSphere ESXi

Issue/Introduction

• ESXi patching fails to download VIB, post VCF authenticated downloads configuration update instructions
• The Stage patches to entity task in vCenter Server fails reporting the Error: VMware vSphere Lifecycle Manager had an unknown error. Check the events and log files for details.
• HTTP 403 "Not Entitled" error may be seen when downloading the ESXi patches/images.
• vCenter Lifecycle Management (vLCM) fails to stage or remediate ESXi patches/images from the new dl.broadcom.com public repositories with following error message:

Cannot download VIB: https://dl.broadcom.com/<yourAuthenticationTokenHere>/PROD/COMP/ESX_HOST/main/esx/vmw/vib20/vibDir/vibnameHere.vib. This might be because of network issues or the specified VIB does NOT exist or does NOT have a proper 'read' privilege set. Please make sure the specified VIB exists and is accessible from vCenter Server

• In the vCenter Server logging (vum-server.log or imageservice.log depending on whether using baselines or images, respectively), the staging failure shows an error to download a VIB.

Log Location: /var/log/vmware/vmware-updatemgr/vum-server/vmware-vum-server-#.log

YYYY-MM-DDTHH:MM:SS.589Z error vmware-vum-server[#####] [originator@#### sub=HostUpdateDepotManager] [logImpl ##] Staging on host: esxihost.domain.com (Entity: host-#####) failed. Error: Failed to download 1 vib: https://dl.broadcom.com/<yourAuthenticationTokenHere>/PROD/COMP/ESX_HOST/main/esx/vmw/vib20/vibDir/vibnameHere.vib
YYYY-MM-DDTHH:MM:SS.596Z error vmware-vum-server[#####] [originator@#### sub=SingleHostStageTask. SingleHostStageTask{##}] [singleHostStageTask ###] singleHostStage: Failed to download

• Copy the full URL (https://dl.broadcom.com/<yourAuthenticationTokenHere>/PROD/COMP/ESX_HOST/main/esx/vmw/vib20/vibDir/vibnameHere.vib in the example above) from that error and paste it into the browser. The message "Not Entitled" is received. 

Note: If a browser returns a different unsuccessful code for the VIB download then this KB does not apply. See VCF Authenticated Downloads Token Troubleshooting Guide for further troubleshooting. 

Environment

vSphere vCenter Server

Cause

Getting a "Not Entitled" error means chosen site doesn't have the right licenses to complete the download.

Resolution

To resolve this issue try the below two resolutions:

1. License Version Mismatch
   1. This happens if license keys in the Broadcom support portal are different than the desired software version.
   2. If version 7 but require 8, upgrade one version 7 key to 8.
   3. If version 8 but require 7, downgrade one version 8 key to 7.
   4. Refer to Upgrade and Downgrade VMware License Keys via the Broadcom support portal to upgrade and downgrade licenses.
2. Wrong Site ID Chosen
   1. If you have several site IDs, you might have picked one that doesn't have licenses for that product/version. To fix this, generate a new token after selecting the correct site ID that has active licenses for the software required.

If neither of these resolutions work, file a non-technical support request to the Global Customer Assistance (GCA) team for help resolving the portal issue. Create a Non Technical case for Support Portal / License / Contract related issues.

Additional Information

• To Obtain the Token: VCF authenticated downloads configuration update instructions
• Similar issue, but with the previous public repository hostupdate.broadcom.com: "A general system error occurred: Failed to download VIB(s): Error: HTTP Error Code: 403", vLCM fails to download the ESXi patches and images from online repositories
• When the token is regenerated, the Lifecycle Manager sync task may take a long time to complete.
• While the sync updates task is running, if remediation is attempted on the ESXi host, it will fail with the below error and refer to the old token in the URL: 
  Cannot download VIB: https://dl.broadcom.com/<old_token>/PROD/COMP/ESX_HOST/main/esx/vmw/vib20/vibDir/vibnameHere.vib. This might be because of network issues or the specified VIB does NOT exist or does NOT have a proper 'read' privilege set. Please make sure the specified VIB exists and is accessible from vCenter Server

Is such scenarios, let the sync task complete and then perform the remediation on the ESXi hosts.