Custom certificate replacement fails after upgrading to vCenter Server Appliance 6.5 Update 1

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• When replacing certificates using the certificate-manager the replacement will fail and perform a rollback:

2017-03-16T09:14:11.41Z INFO certificate-manager please see service-control.log for service status

Service-control failed. Error Failed to start vmon services.vmon-cli RC=1, stderr=Failed to start updatemgr services. Error: Operation timed out

2017-03-16T09:28:15.585Z ERROR certificate-manager None

2017-03-16T09:28:15.585Z ERROR certificate-manager Error while starting services, please see log for more details

2017-03-16T09:28:15.585Z ERROR certificate-manager Error while replacing Machine SSL Cert, please see /var/log/vmware/vmcad/certificate-manager.log for more information.

2017-03-16T09:28:15.585Z ERROR certificate-manager {

"resolution": null,

"detail": [

{

"args": [

"None"

],

"id": "install.ciscommon.command.errinvoke",

"localized": "An error occurred while invoking external command : 'None'",

"translatable": "An error occurred while invoking external command : '%(0)s'"

},

"Error while starting services, please see log for more details"

],

"componentKey": null,

"problemId": null

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware vCenter Server Appliance 6.5.x

Cause

After you upgrade from vCenter Server Appliance 6.5 to 6.5 Update 1 and try to replace the Machine SSL certificate of vCenter Server Appliance, the operation fails because the vSphere Update Manager service cannot access the /etc/vmware/.buildinfo file as the file permission changed from 444 to 640.

Resolution

This issue is resolved in vCenter Server 6.5 Update 2. 

Workaround:
To workaround the issue follow the steps below:

1. Log in as root to the vCenter Server Appliance. 
2. Change the file permission of /etc/vmware/.buildinfo from 640 back to 444 by running the following command
   chmod 444 /etc/vmware/.buildinfo 
3. Replace the Machine SSL certificate, please see Replacing a vSphere 6.x Machine SSL certificate with a Custom Certificate Authority Signed Certificate for more information