Error: "Could not retrieve trusted root certificates from vCenter" when importing vCenter into VCF Operations 9
search cancel

Error: "Could not retrieve trusted root certificates from vCenter" when importing vCenter into VCF Operations 9

book

Article ID: 418133

calendar_today

Updated On:

Products

VMware Cloud Foundation

Issue/Introduction

During a VMware Cloud Foundation (VCF) 9.x brownfield import or workload domain integration, the process fails during the precheck phase. This prevents the SDDC Manager from establishing a secure connection with the target vCenter Server."

  • When importing a vCenter, it fails on the Precheck Stage with an error."Could not retrieve trusted root certificates from vCenter <vCenterFQDN>"  or "InternalServerError".
  • /var/log/vmware/vcf/domainmanager/domainmanager.log shows the following error

    DEBUG [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-7200-exec-5]  Processing localizable exception Could not retrieve trusted root certificates from vCenter <vCenterFQDN>.

    ERROR [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-7200-exec-5]  FAILED_TO_RETRIEVE_VC_TRUSTED_ROOT_CERTS Could not retrieve trusted root certificates from vCenter <vCenterFQDN>.

    Caused by: org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 : "{"errorCode":"CERT_VALIDATION_ERROR","arguments":[],"message":"Error while validating certificate","causes":[{"type":"java.security.cert.CertificateExpiredException","message":"NotAfter: <cert expiry date>"}],"referenceToken":"#######"}"

  • /var/log/vmware/vcf/lcm/lcm.log shows the following error:

    WARN [c.v.v.s.config.TrustAllTrustManager,http-nio-127.0.0.1-7100-exec-13] Trusting server
    [o.b.jsse.provider.ProvTlsClient,http-nio-127.0.0.1-7100-exec-13] [client #1964 @4b######0] established connection with vcsa.example.com:443

    [c.v.v.l.a.a.ActivityLoggingInterceptor,http-nio-127.0.0.1-7100-exec-22] {"username":"vcfsvcs","timestamp":"Date.time","clientIP":"127.0.0.1","userAgent":"Swagger-Codegen/1.0.0/java","api":"/v1/resource-functionalities/global","httpMethod":"GET","httpStatus":200,"operation":"Get Resource Functionalities Allowed Global Configuration","remoteIP":"127.0.0.1","duration":1}
    [c.v.e.s.a.u.a.r.CertificateController,http-nio-127.0.0.1-7100-exec-21] Add Certificate to truststore

    ERROR [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-7100-exec-21]  CERT_VALIDATION_ERROR Error while validating certificate

    Caused by: java.security.cert.CertificateExpiredException: NotAfter: <Cert expiry date>

Environment

VCF 9.x

Cause

The SDDC Manager cannot establish a secure handshake with the vCenter Server due to one of the following:

  • Expired Certificates: The vCenter Server TRUSTED_ROOTS store contains expired or stale Certificate Authority (CA) certificates.
  • Stale SDDC Metadata: The SDDC Manager internal truststore contains orphaned certificate entries from a previous association with the same vCenter.
  • SSO Domain Mismatch: The import workflow was initiated with the default administrator@vsphere.local account, but the target vCenter is configured with a custom Single Sign-On (SSO) domain.

Resolution

Prerequisites


Step 1: Clean the vCenter Trusted Root Store
Identify and remove expired CA certificates from the vCenter TRUSTED_ROOTS store:

  1. Verify and remove CA Certificates from the TRUSTED_ROOTS store in the VMware Endpoint Certificate Store(VECS)
  2. Alternatively, use the scripted utility vCert - Scripted vCenter expired certificate replacement.

Step 2: Purge the SDDC Manager Internal Truststore

    1. Access the SDDC Manager via SSH using the vcf user and switch to root.
    2. Retrieve the truststore password:

      KEY=$(cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key)

    3. List the certificates to identify stale aliases (look for NotAfter dates in the past):

      keytool -list -v -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $KEY

    4. Delete the orphaned or expired entry by its alias:

      keytool -delete -alias [ALIAS_NAME] -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $KEY

Step 3: Refresh and Retry

  1. If the failure was due to an SSO mismatch, restart the import wizard and ensure the SSO Username matches the target vCenter's domain (e.g., administrator@vsphere.corp).
  2. Refresh the trusted certificates on SDDC Manager via API:

    curl -X POST localhost/appliancemanager/trustedCertificates/refresh

  3. Restart the import task in the VCF Operations UI.

Additional Information

Powered by Wolken Software